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A. 

I  still  continued  to  do  the  target  analyst  job. 

Q. 

Did  you  still  have  Specialist  Showman  working  for  you? 

A. 

She  was  still  in  the  SCIF  and  we  were  working  together  to 

continue  the  targeting  mission  that  we  had. 

Q.  During  your  entire  time  did  you  ever  get  information  you 
needed  from  the  S-2  section? 


A. 

Yes. 

Q. 

And  when  was  that? 

A. 

Over  the  course  of  the  4  months  that  I  worked  in  the  SCIF 

itself  we 

still  received  reporting.  It  wasn't  that  we  weren't 

getting  any  reporting.  Every  once  in  a  while  we  would  get  something 
that  was  relevant  to  what  we  were  doing. 

Q.  Now,  I  want  to  ask  you  about  your  experience.  You  tell  me 
if  you  are  or  not.  Are  you  experienced  with  looking  at  intelligence 


products? 

A. 

I  am. 

Q. 

Are  you  familiar  with  intelligence  terms? 

A. 

Yes. 

Q. 

Do  you  know  what  an  intelligence  gap  means? 

A. 

An  intelligence  gap  to  me  is  information  that  we  do  not 

currently 

have.  It's  lacking  at  that  point. 

CDC [MR.  COOMBS]:  Thank  you.  Chief 

MJ:  Redirect? 
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ATC [CPT  WHYTE]:  We  have  no  questions.  Your  Honor. 

[The  witness  was  duly  warned  and  withdrew  from  the  courtroom.] 

CDC[MR.  COOMBS]:  Ma'am,  I'm  sorry.  It  might  have  been  said 

and  I  just  missed  it.  Is  he  a  permanent  excusal? 

MJ:  No,  I  temporarily  excused  him.  Do  the  parties  want  him 

permanently  excused? 

CDC[MR.  COOMBS]:  I'd  like  to  have  him  permanently  excused 

just  because  he  is  OCONUS,  ma'am. 

TC [MAJ  FEIN]:  The  United  States  would  request  temporary  for 
him,  ma'am.  We'll  keep  him  up  to  date. 

MJ:  Why  don't  we  —  let's  go  temporarily. 

TC [MAJ  FEIN]:  United  States  asks  for  a  10-minute  recess  in 
order  to  get  classified  information  out. 

MJ:  The  Court  is  in  recess. 

[The  court-martial  recessed  at  1420,  5  June  2013.] 

[The  court-martial  was  called  to  order  at  1433,  5  June  2013.] 

MJ:  The  Court  is  called  to  order.  Let  the  record  reflect  all 

parties  present  when  the  court  last  recessed  are  again  present  in 
court . 

Are  the  parties  ready  to  proceed? 

ATC [WHYTE]:  Yes,  ma'am. 

CDC [MR.  COOMBS]:  Yes,  Your  Honor. 

ATC [CPT  WHYTE]:  The  United  States  calls  Captain  Casey  Fulton. 
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CAPTAIN  CASEY  FULTON,  U.S.  Army,  was  called  as  a  witness  for  the 
government,  was  sworn  and  testified  as  follows: 

DIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  WHYTE] : 

Q.  You  are  Captain  Casey  Fulton? 

A.  Yes. 

Q.  Captain  Fulton,  what  is  your  current  position? 

A.  I'm  an  intelligence  observer  coach  trainer. 

Q.  Where  are  you  stationed? 

A.  At  the  Joint  Multinational  Training  Center  in  Hohenfels, 
Germany. 


Q. 

A. 

training 

Q. 

A. 

Q. 

A. 

Q. 

A. 

Q. 


What  are  your  responsibilities  in  that  position? 

I  coach,  train  rotational  units  through  scenario  based 
exercises . 

How  long  have  you  been  in  that  position? 

Ten  months. 

And  what  is  your  branch? 

Intelligence,  military  intelligence. 

How  long  and  military  intelligence  officer? 

Seven-and-a  half  years. 

What  initial  training  did  you  receive  to  become  an  MI 


officer? 
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A.  I  went  to  the  Intelligence  Officer  Basic  course  and  I  went 
to  the  Military  Intelligence  Captains  Career  course. 

Q.  After  the  basic  course,  what  was  your  first  assignment? 

A.  I  was  assigned  to  508th  STB  4th  Brigade  82d  Airborne. 

Q.  And  what  happened  when  you  arrived  at  Fort  Bragg? 

A.  I  was  deployed  immediately  to  Afghanistan. 

Q.  How  long  was  this  deployment? 

A.  One  year. 

Q.  What  was  your  position  during  that  deployment? 

A.  I  was  an  assistant  S-2  for  the  battalion. 

Q.  What  were  your  responsibilities  in  that  position? 

A.  My  primary  responsibilities  were  collection  management,  and 
current  operations. 

Q.  So  after  that  year  what  happened  next,  you  redeployed? 

A.  Yes,  I  redeployed  to  Fort  Bragg,  and  then  I  became  a 
platoon  leader  in  the  MI  Co. 

Q.  What  is  the  MI  Co? 

A.  The  MI  Company. 

Q.  MI,  military  intelligence  company? 

A.  Correct. 

Q.  How  long  were  you  at  Bragg  after  you  redeployed? 

A.  About  9  months. 

Q.  And  what  happened  after  those  9  months? 
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A.  I  got  orders  to  go  to  the  MI  Captains  Career  course. 

Q.  How  long  was  that  Captains  Career  course? 

A.  Four  to  five  months. 

Q.  What  type  of  training  did  you  receive  at  the  Captains 
Career  Course? 

A.  We  learned  how  to  do  the  mission  analysis  portion  of  the 
MDMP.  We  did  --  we  covered  all  the  different  types  of  intelligence 
disciplines,  handling  classification  information,  collection 
management . 

Q.  Can  you  explain  to  the  Court  what  the  mission  analysis  is? 

A.  It's  step  2  of  the  military  decision-making  process. 

Q.  What  does  that  consist  of? 

A.  Step  2  is  where  the  staff  gathers  all  the  information  and 
conducts  analysis  on  the  current  conditions  of  the  operating 
environment . 

Q.  Is  that  the  intel  portion  of  the  MDMP? 

A.  Yes.  It's  a  big  focus  for  the  Intel  section. 

Q.  What  was  your  first  assignment  out  of  the  Captain  Career 

Course? 

A.  To  2nd  Brigade  10th  Mountain. 

Q.  When  did  you  arrive  at  Fort  Drum? 

A.  September  2009. 
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1  Q.  Let's  talk  about  your  time  at  Fort  Drum  in  garrison.  What 

2  was  your  position  when  you  arrived  at  Fort  Drum? 

3  A.  I  was  the  S-2  plans. 

4  Q.  And  how  long  were  you  the  S-2  plans  in  garrison? 

5  A.  I  was  the  S-2  plans  for  about  2  weeks  before  the  unit 

6  started  to  deploy. 

7  Q.  Where  did  you  work  at  Fort  Drum? 

8  A.  In  the  SCIF. 

9  Q.  How  do  you  know  PFC  Manning? 

10  A.  He  also  worked  in  the  S-2  section  in  the  SCIF. 

11  Q.  So  what  were  your  responsibilities  as  S-2  plans  officer  in 

12  garrison? 

13  A.  I  was  creating  the  intelligence  portion  of  the  operations 

14  order  for  the  deployment  operations  order. 

15  Q.  And  what  is  the  operation  order  for  the  deployment? 

16  A.  It  was  basically  the  order  that  was  going  to  get  us  into 

17  theatre.  The  focus  would  have  been  force  array  once  we  got  into 

18  theatre. 

19  Q.  What  type  of  information  was  included  in  the  intel  portion 

20  of  this  order? 

21  A.  The  enemy  threat  for  the  area  that  we  were  assuming. 

22  Q.  And  who  helped  you  create  this  portion  of  the  OPORD? 
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A.  PFC  Manning  helped.  Sergeant  —  Mr.  Balonek  helped,  Mr. 
Ehresman  helped.  That  was  about  it. 

Q.  How  did  PFC  Manning  help  you  with  this? 

A.  He  gave  me  a  base  of  knowledge  on  all  the  enemy  threat 

groups  when  I  first  got  there  so  I  could  get  started. 

Q.  For  the  intended  —  the  threat  groups  for  the  intended  AO? 

A.  Yes. 

Q.  How  long  were  you  at  Fort  Drum  again? 

A.  I  was  only  there  a  month  and  a  half  before  I  deployed,  but 
I  was  only  there  2  weeks  before  the  unit  started  to  deploy. 

Q.  And  where  did  you  deploy  to? 

A.  FOB  Hammer,  Iraq. 

Q.  Do  you  remember  when  you  deployed? 

A.  November  2009. 

Q.  And  did  PFC  Manning  deploy  as  well  to  Hammer? 

A.  Yes,  he  did. 

Q.  What  section  within  FOB  Hammer  did  you  work? 

A.  I  was  in  the  S-2  plans  in  the  S-2  section. 

Q.  Can  you  describe  how  the  S-2  section  was  organized  at  FOB 
Hammer? 


A.  We  had  a  Current  OPs  section,  which  was  in  the  tactical 
operations  center.  We  had  the  S-2  plans,  which  consisted  of  myself. 
We  had  a  fusion  cell,  which  had  most  of  the  analysts,  the  rest  of  the 
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shop  with  the  exception  of  one  analyst  that  was  assigned  to  Chief 
Hack,  who  was  part  of  the  targeting  section.  We  also  had  an  S-2X, 
which  is  the  HUMINT  cell,  and  a  SIGNET  section. 

Q.  You  said  there  was  a  Current  OPs  section.  What  is  current 
operations? 

A.  They  handle  all  the  current  operations  within  an  96  hour 
window. 

Q.  And  you  said  you  were  plans,  so  what  was  your  focus? 

A.  Anything  beyond  96  hours.  I  would  be  doing  all  the  long 
term  plans,  the  intel  portions  of  the  OP  orders  for  long  term 
operations . 

Q.  How  did  the  fusion  cell  fit  in  in  the  S-2  section? 

A.  When  we  do  mission  analysis,  you  create  a  running  estimate. 

The  fusion  cell  is  constantly  updating  that  running  estimate.  That's 
what  we  do  on  a  daily  basis  for  intel.  It  feeds  current  operations, 
plans  and  targeting. 

Q.  Where  did  you  work  when  you  were  at  FOB  Hammer? 

A.  In  the  SCIF. 

Q.  Where  did  PFC  Manning  work? 

A.  In  the  SCIF. 

Q.  Let's  talk  about  the  SCIF  just  really  quickly.  Who  had 
access  to  the  SCIF  at  FOB  Hammer? 
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A.  The  S-2  section,  the  whole  S-2  section.  Chief  Hack  and  we 
had  civilian  contractors. 

Q.  So  how  did  you  know  if  someone  had  access  to  the  SCIF  or 

not? 

A.  Well,  we  all  knew  each  other  within  our  respective  areas. 

We  all  worked  in  the  same  room.  They're  on  an  access  roster.  They 
have  the  code  to  get  in  the  door. 

Q.  What  is  —  what's  an  access  roster? 

A.  It's  a  memorandum  that  lists  all  the  individuals  that  have 
access  to  the  SCIF. 

Q.  So  what  happened  if  someone  who  was  not  on  the  access 
roster  needed  to  enter  the  SCIF? 

A.  It  would  depend  on  what  classification  or  clearance  they 
hold,  but  everyone  in  the  SCIF  would  be  notified  that  a  person  was 
coming  in  and,  if  necessary,  the  area  would  be  sanitized  to  the 
proper  level  of  clearance  that  they  had  authorization  for. 

Q.  So  what  do  you  mean  by  sanitize? 

A.  If  they  don't  have  authorization  to  view  classified 
material,  it  would  be  put  out  of  site,  computers  would  be  turned  off, 
or  at  least  the  monitors  would  be  turned  off  so  nothing  was  showing 
so  they  could  inadvertently  have  access  to  information  they 
shouldn' t . 

Q.  Who  was  responsible  for  sanitizing  the  SCIF? 
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A.  All  of  us. 

Q.  How  often  did  this  happen? 

A.  We  did  have  people  come  in  frequently  that  only  had  a 
Secret  clearance,  but  anything  beyond  that  only  happened  very  rarely. 

Q.  Which  networks  did  PFC  Manning  have  access  to  at  FOB 
Hammer? 

A.  SIPR  and  NIPR. 

Q.  Can  you  explain  the  use  of  SIPRNET  in  garrison  versus  in 
theatre? 

A.  In  theatre  it's  a  primary  method  of  commination,  SIPR  is, 
while  NIPR  is  the  primary  method  of  communication  in  garrison. 

Q.  What  classification  level  is  information  on  SIPRNET? 

A.  Secret. 

Q.  What's  the  presumption  of  information  on  SIPRNET? 

A.  If  it's  not  marked,  that  it's  Secret. 

Q.  And  how  do  you  know  that? 

A.  Because  it  is  rule  of  thumb  to  assume  a  higher 
classification. 

Q.  Was  —  how  do  you  know  that  that's  the  general  rule? 

A.  Training. 

Q.  Was  PFC  Manning  authorized  to  remove  classified  information 
for  personal  use? 

A.  No. 
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Q.  Was  PFC  Manning  authorized  to  give  classified  information 
to  WikiLeaks? 

A.  No. 

Q.  Why  not? 

A.  Because  you're  not  allowed  to  disclose  information  to 
individuals  who  do  not  have  authorization  to  view  that  type  of 
material . 

Q.  What  was  your  position  when  you  arrived  at  FOB  Hammer? 

A.  I  was  still  in  the  S-2  plans. 

Q.  And  in  theatre  what  were  you  responsibilities? 

A.  As  the  S-2  plans? 

Q.  Yes. 

A.  Well,  I  did  the  intelligence  portion  for  the  operations 
orders  that  we  created. 

Q.  And  what  type  of  operation  orders  were  you  creating? 

A.  The  first  one  that  I  did  was  for  election  security,  which 
is  our  main  focus  while  we  were  there.  I  also  did  the  intel  portion 
for  the  transition  and  withdraw,  base  closures. 

Q.  So  what  type  of  information  was  included  in  the  intel 
portion  of  the  election  security  OPORD? 

A.  Information  on  the  Iraqi  elections,  how  they  were  going  to 
be  conducted,  political  groups,  as  well  as  historical  data  on  what 
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has  happened  in  the  past  during  the  elections  and  also  current  enemy 
activity. 


Q.  How  many  intelligence  analysts  worked  for  in  S-2  plans, 
work  solely  for  you? 

A.  None. 

Q.  So  who  assisted  you  in  creating  some  of  this  work  product? 

A.  Well,  I  had  to  request  assistance  from  the  analyst.  So  it 
was  generally  either  PFC  Manning  or  Sergeant  —  Mr.  Balonek. 

Q.  So  how  did  PFC  Manning  specifically  help  you  in 
accomplishing  your  mission? 

A.  I  gave  him  projects  that  focused  on  collecting,  gathering  a 
whole  bunch  of  data,  organizing  it,  and  displaying  it  on  the  map. 

Q.  Why  did  you  ask  him  specifically? 

A.  Because  he  was  good  with  computers.  He  could  get  it  done 
quicker. 


Q.  What  type  of  information  was  he  pulling  for  you? 

A.  Significant  activities,  enemy  SIGACTs. 

Q.  Do  you  remember  what  type  of  SIGACTs  he  was  pulling? 

A.  No.  I  mean,  we  specifically  usually  focused  on  IEDs,  small 

arms,  firearms  and  indirect  fire.  Those  are  the  three  big  ones,  but 
we  also  focused  on  VBIEDs  because  of  the  elections. 

Q.  After  you  pulled  this  information,  what  would  PFC  Manning 


do  next? 
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A.  He'd  pull  it.  He  would  organize  it,  sort  it,  and  then, 
like  I  said,  he  would  put  it  on  the  map  so  it  was  represented 
visually. 

Q.  And  what  is  the  purpose  of  putting  this  information  on  a 

map? 


A.  That  way  you  could  conduct  analysis  based  on  the  patterns, 
the  engagement  areas  that  are  represented. 

Q.  What  type  of  analysis  on  --  what  type  of  analysis? 

A.  Yes.  I  mean,  we  do  pattern  analysis  in  order  to  identify 
enemy  activity. 

Q.  What  would  you  do  with  the  work  product  you  received  from 
PFC  Manning? 

A.  It  was  incorporated  into  product  that  I  was  working  on  and 
then  it  was  presented  to  the  commander  so  that  he  could  give  guidance 
on  a  course  of  action  to  be  developed. 

Q.  Did  you  brief  the  commander? 

A.  Yes. 

Q.  How  often? 

A.  About  maybe  once  a  week,  once  every  2  weeks.  It  depended. 

Q.  During  deployment  what  additional  responsibilities  did  you 
take  on? 


A.  I  was  eventually  —  I  was  counseled  as  the  assistant  S-2. 
Q.  Do  you  remember  when  this  happened? 
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A. 

February. 

Q. 

Can  you  explain  a  specific  task  you  delegated  to  PFC 

Manning 

when  you  were  the  assistant  S-2? 

A. 

Yeah.  The  —  another  staff  section  required  —  they  wanted 

all  the 

significant  activity  that  occurred  while  we  were  in  theatre 

compiled  in  order  to  see  whether  the  events  had  decreased  or 
increased  while  we  were  there.  So  he  did  trend  analysis  on  all  those 
SIGACTs. 


Q. 

What  was  the  purpose  of  this  project? 

A. 

It  —  essentially  to  see  whether  SIGACTs  had  increased  or 

decreased  while  we  were  there  in  theatre,  whether  we  had  made  an 
impact  on  the  environment . 

Q.  Let's  move  on  to  another  subject.  Are  you  familiar  with 
the  Apache  video? 


A. 

Yes. 

Q. 

When  did  you  first  watch  the  Apache  video? 

A. 

It  was  early  on  the  in  deployment.  It  would  be  in  the 

December  time  frame  maybe 


Q. 

Where  did  you  see  it? 

A. 

It  was  displayed  on  Showman's  computer. 

Q. 

In  the  SCIF? 

A. 

Yes . 

Q. 

On  what  network  was  the  video? 
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A.  SIPR. 

Q.  When  did  you  go  on  R  and  R? 

A.  April. 

Q.  What  happened  when  you  returned  from  R  and  R? 

A.  I  had  asked  the  individuals  in  the  shop  if  they  had  seen 
the  video  that  had  been  put  out  on  the  news. 

Q.  And  how  did  PFC  Manning  react? 

A.  He  came  up  to  me  after  I  discussed  it  with  the  Soldiers  in 
the  shop  and  told  me  that  he  thought  that  that  was  the  same  video  we 
had  on  our  shared  drive. 

Q.  What  did  he  do  next? 

A.  Well,  I  told  him  I  didn't  think  it  was  the  same  video 
because  it  had  obviously  been  edited,  so  it  didn't  look  the  same  when 
I  saw  it.  I  said,  "No,  I  would  have  to  see  both  videos  in  order  to 
make  that  determination."  He  sent  me  an  e-mail  with  a  link  to  those 
videos  clips  —  two  video  clips  that  were  labeled  as  the  one  on  our 
share  drive  and  the  one  that  was  in  the  media  so  that  I  could  see 
both  of  the  video  clips. 

Q.  And  obviously  when  you're  talking  about  —  this  email  —  on 
what  network  was  this  email  sent? 

A.  SIPR. 
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Q.  So  when  we're  talking  about  this  email  obviously  in  an 
unclassified  setting,  given  our  setting  here.  Do  you  remember 


receiving 

this  email? 

A. 

Yes . 

Q. 

And  can  you  explain  what  this  email  consisted  of  again? 

A. 

A  hyperlink  to  the  share  drive. 

Q. 

What  did  you  do  when  you  received  this  email? 

A. 

I  clicked  on  the  link  and  I  watched  the  videos  and  I 

responded 

to  them  via  email,  surprised  that  it  was  the  same  — 

admitting 

that  I  was  surprised  to  see  that  it  was  the  same  video. 

Q. 

How  long  after  watching  the  video  did  you  send  this  email? 

A. 

Immediately.  I  think. 

ATC[CPT  WHYTE]:  Your  Honor,  at  this  time  we  would  offer  into 

evidence  what  has  been  marked  as  Prosecution  Exhibit  55  for 
Identification . 

CDC [MR.  COOMBS]:  No  objection.  Your  Honor. 

MJ:  All  right. 

ATC [OPT  WHYTE]:  And  also  at  this  time.  Your  Honor,  we'd 

offer  Prosecution  Exhibit  56  for  Identification. 

CDC [MR .  COOMBS]:  Again,  no  objection.  Your  Honor. 


MJ: 

Okay.  I'll  mark  them  at  the  recess. 

Questions 

continued  by  the  assistant  trial  counsel  [CPT  WHYTE] : 

Q. 

When  did  you  redeploy  to  Drum? 
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A.  July  of  2010. 

Q.  Did  you  work  in  the  S-2  shop  for  the  entire  deployment? 

A.  Yes. 

Q.  Did  PFC  Manning  work  in  the  S-2  shop  for  the  entire 
deployment? 

A.  Until  I  had  to  have  him  removed,  yes. 

Q.  Do  you  remember  approximately  on  what  date  PFC  Manning  - 

A.  April.  Late  April,  maybe  early  May. 

ATC [CPT  WHYTE]:  Thank  you.  We  have  no  more  questions. 

CROSS-EXAMINATION 

Questions  by  the  civilian  defense  counsel  [MR.  COOMBS] : 

Q.  How  are  you  doing.  Captain  Fulton? 

A.  I'm  good. 

Q.  Good.  Just  a  few  questions  for  you.  I  want  to  start  off 
by  asking  you  about  something  the  government  talked  about  when  you 
first  arrived  at  the  unit.  Okay? 

A.  Okay. 

Q.  And  that  was  you  were  putting  together  an  OP  order  for  your 
brigade? 

A.  Correct. 

Q.  And  that  OP  order  was  basically  to  define  the  purpose  of 
the  S-2  operations  in  relation  to  the  brigade's  mission;  is  that 
right? 
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A.  Yes,  and  the  operating  environment  we  were  going  to. 

Q.  And  as  part  of  that  process  then  you  would  consider  the 
operation,  the  end  state  with  respect  to  the  relationship  among  the 
force  and  also  the  enemy  and  the  terrain;  is  that  right? 

A.  Correct. 

Q.  And  during  that  time  there  was  minimal  SIPRNET  access 
available? 

A.  That's  correct. 

Q.  So  you  first  went  to  the  First  Lieutenant  Elizabeth  Fields 
to  get  a  picture  of  the  enemy? 

A.  Yes. 

Q.  And  you  needed  that  picture  of  that  enemy  as  part  of  your 
OP  order? 

A.  Correct. 

Q.  When  you  say  a  picture  of  the  enemy,  you  mean  basically 
kind  of  a  general  overall  impression  of  the  enemy  that  was  operating 
within  your  area  of  operation? 

A.  Yes.  Specifically,  I  was  looking  for  the  enemy  threat 
groups  that  were  operating  within  our  environment . 

Q.  Okay.  So  it  was  the  different  basically  insurgent  threat 
groups  as  opposed  to  the  enemy  in  general? 

A.  Correct. 
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Q.  And  you  basically  wanted  to  determine  the  location,  the 
known  location,  of  enemy  operations? 

A.  Yes. 

Q.  And  you  wanted  to  determine  the  last  known  activity  of  the 
enemy? 

A.  Yes. 

Q.  Basically  is  he  attacking,  is  he  retreating,  defending, 
patrolling,  that  type  of  stuff? 

A.  And  their  TTPs  and  how  they  operate,  yes. 

Q.  And  you  wanted  to  get  an  idea  of  strength  of  the  enemy  as 

well? 

A.  Yes. 

Q.  So  first  you  went  to  Lieutenant  Fields,  she  then  pointed  to 
PFC  Manning  as  somebody  who  knew  about  the  different  insurgent  groups 
that  were  operating  within  the  area  of  operation? 

A.  Yes. 

Q.  And  you  went  to  speak  with  PFC  Manning? 

A.  Correct. 

Q.  Your  conversation  really  wasn't  very  long  though? 

A.  No. 

Q.  Basically  lasted  about  10  to  15  minutes? 

A.  Maybe.  I  don't  know  how  long  it  lasted. 

Q.  Do  you  think  it  lasted  longer  than  that? 
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A. 

No,  probably  not. 

Q. 

And  he  could  basically  give  the  names  of  the  enemy  groups 

and  whether  they  were  Sunni  or  Shia? 


A. 

Correct . 

Q. 

He  didn't  have  a  lot  of  details  that  you  actually  needed? 

A. 

No. 

Q. 

And  basically  after  talking  to  him  for  that  short  period  of 

time  then  you  did  your  own  research  on  the  enemy  threat? 


A. 

Correct . 

Q. 

You  spent  approximately  the  next  several  hours  pulling 

information  that  you  needed  to  truly  identify  the  enemy  threat? 


A. 

That's  correct. 

Q. 

Now,  I  want  to  talk  about  your  experience  in  working  with 

PFC  Manning.  Okay? 


A. 

Okay. 

Q. 

After  working  with  him  for  a  short  period  of  time,  you 

noticed  that  he  was  a  junior  analyst? 


A. 

Yes . 

Q. 

As  a  junior  analyst  he  basically  missed  the  so  what  factor; 

is  that 

correct? 

A. 

Yes.  The  analysis,  usually  that  comes  with  experience. 

Q. 

So  he  really  couldn't  give  you  a  good  amount  analytical 

product 

that  you  needed? 
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A.  Not  the  analysis  portion,  yes. 

Q.  And  that  wasn't  really  surprising  because  of  the  level  of 
his  experience? 

A.  Yes. 

Q.  And  really  creating  a  good  analytical  product  from  the 
analysis  standpoint  takes  time  to  develop  that  skill? 

A.  Yes. 

It  takes  experience? 

Yes . 

And  PFC  Manning  was  inexperienced? 

Correct . 

He  was  still  learning? 

Yes . 

Now,  he  wasn't  an  expert  analyst  when  it  came  to  the 
different  insurgent  groups  in  Iraq,  was  he? 

A.  What  do  you  mean? 

Q.  Would  you  consider  him  an  expert  analyst  on  the  different 
insurgent  groups  in  Iraq? 

A.  No. 

Q.  Would  you  consider  him  an  expert  analyst  on  the  enemy 
threat  as  a  whole  to  the  United  States? 

A.  No. 


Q. 

A. 

Q. 

A. 

Q. 

A. 

Q. 
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Q.  Now,  even  though  PFC  Manning  was  not  an  expert  analyst  at 
this  point,  he  was  very  good  with  computers? 

A.  Correct. 

Q.  And  during  the  deployment,  you  frequently  assigned  him 
computer  data  entry  products  based  upon  his  skills? 

A.  Correct. 

Q.  And  the  skills  you  assigned  him,  they  actually  did  require 
computer  knowledge? 

A.  Yes. 

Q.  And  he  could  really  do  a  good  job  of  importing  and 
exporting  information  in  Excel? 

A.  Yes. 

Q.  And  you  knew  that  he  understood  the  various  programs  that 
are  on  the  DCGS  system? 

A.  Yes. 

Q.  He  also  did  a  very  good  job  of  plotting  data  points  on 

maps? 

A.  Yes. 

Q.  You  saw  his  computer  skills  as  his  real  strength  as  a 
junior  analyst? 

A.  That's  correct. 

Q.  And  you  used  those  strengths,  as  any  officer  would,  to  help 
improve  your  S-2  products? 
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A.  Yes. 

Q.  Now,  within  S-2  plans,  you  testified  on  direct,  that  it  was 
the  MDMP  process  that  you  were  constantly  going  through;  is  that 
right? 

A.  That's  correct. 

Q.  The  military  decision-making  process? 

A.  Correct. 

Q.  And  you  needed  his  assistance  in  pulling  certain  data  in 
that  process? 

A.  Yes. 

Q.  You  would  ask  him  to  take  that  data  and  put  it  on  a  map? 

A.  Yes. 

Q.  And  then  once  he  did  that,  you  would  actually  do  the 
analysis? 


A.  That's  correct. 

Q.  You  didn't  rely  upon  him  to  do  the  analysis? 


Q.  And  why  was  that? 

A.  Well,  because  he  was  a  junior  analyst  and  I  would  talk 
through  the  product  with  him  as  a  learning  point,  but  when  it  came 
down  do  it,  I  did  —  being  more  experienced  I  did  my  own  analysis  on 
it. 

Q.  And  during  the  deployment  you  worked  out  of  the  SCIF? 
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A.  That's  correct. 

Q.  And  my  understanding,  for  the  most  part,  your  primary 
mission  was  election  security? 

A.  Yes,  for  most  of  the  deployment. 

Q.  And  you  spent  a  large  amount  of  time  working  on  products 
for  election  security? 

A.  Yes,  or  within  that  operation  order,  yes. 

Q.  And  on  direct  it  was  essentially  these  products  were  being 
used  apparently  for  the  commander  to  make  certain  decisions  on 
courses  of  action? 

A.  That's  correct. 

Q.  Now,  obviously,  these  products  were  very  important  for  your 
brigade? 

A.  Yes. 

Q.  And  you  assigned  PFC  Manning  several  duties  to  complete  in 
order  to  help  you  on  the  products  that  you  needed  to  produce? 

A.  Yes. 

Q.  My  understanding  is  you  were  assigning  him  these  projects 
pretty  much  on  a  freguent  basis  from  November  of  2009,  to  the  time 
that  the  elections  happened  in  March  of  2010? 

A.  You'd  have  to  define  frequent,  but  there  were  a  few 
taskings,  yes. 
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Q.  I'd  like  you  to  define  frequent  for  me.  How  often  were  you 
tasking  him? 

A.  It  would  depend  on  what  the  project  was  that  we  were 
working  on  within  that  time  frame.  Some  were  specific  to  his 
section.  Some  weren't.  So  if  it  was  specific  to  his  section  and  we 
were  under  time  constraints,  then  I  would  request  assistance.  It 
wasn't  a  daily  event. 

Q.  Did  he  work  a  lot  for  you  during  this  time? 

A.  I  wouldn't  say  a  lot.  He  was  the  analyst  that  I  went  to 

when  I  needed  assistance,  but  I  did  a  lot  of  it  on  my  own. 

Q.  I  know  it's  taking  you  back  a  few  years,  but  for  the 
military  judge,  would  you  give  an  approximation  of  how  often  would 
you  task  him? 

A.  I  don't  know  if  I  would  even  be  able  to  give  you  an 
approximate  number  of  times. 

Q.  And  that's  just  due  to  the  time  period  that's  gone  on? 

A.  I  don't  remember  how  many  times  he  was  tasked. 

Q.  Safe  to  say  he  worked  for  you? 

A.  On  occasions. 

Q.  We'll  he  go  with  that.  When  he  was  assigned  tasks  he 
completed  those  tasks? 

A.  Yes. 

Q.  And  he  completed  those  tasks  in  a  timely  fashion? 
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A.  Yes. 

Q.  You  never  noticed  a  drop  in  his  performance,  did  you? 

A.  No,  not  in  the  stuff  that  I  assigned  him,  no. 

Q.  And  did  anyone  ever  come  to  you  and  say  that  PFC  Manning's 

performance  had  dropped? 

A.  No,  not  specifically  --  there  was  discussions  about  certain 
things,  but  not  analytical  performance,  no. 

Q.  All  right.  Now,  let's  talk  about  one  of  the  things  that 
came  out  on  direct.  You  mentioned  that  PFC  Manning  was  tasked  to  do 
a  trend  analysis  of  SIGACTs  for  the  brigade? 

A.  Yes. 

Q.  What  was  this  project  again? 

A.  It  was  essentially  it  just  supposed  to  show  increase  and 
decrease  over  time  since  we've  been  in  theatre,  whether  SIGACTs  had 
increased  or  decreased  since  we  were  there. 

Q.  And  how  would  PFC  Manning  create  a  product  like  that? 

A.  He  pulled  all  the  SIGACTs  from  CIDNE,  organized  them  on  an 

Excel  spreadsheet  and  then  you  can  use  the  charts  with  an  Excel 
spreadsheet  is  to  create,  show,  identify  trends. 

Q.  And  I  imagine  what  was  of  use  and  benefit  was  not  only 
pulling  that  data  but  also  indicating  what  type  of  SIGACT  it  was? 

A.  Yes.  Organizing  it,  yes. 
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Q.  So  that  would  identify  in  it  was  an  enemy  threat  type 
SIGACT? 

A.  Yes. 

Q.  Or  enemy  engagement? 

A.  Yes. 

Q.  Or  civilian  death? 

A.  Yes. 

Q.  And  PFC  Manning  had  reviewed  those  SIGACTs  in  order  to 
create  the  product? 

A.  Correct. 

Q.  I  want  to  ask  you  about  analytical  products  in  general.  Are 
you  familiar  with  the  term  intelligence  gap? 

A.  Yes. 

Q.  And  when  would  you  call  something  an  intelligence  gap? 

A.  When  you  don't  have  any  information. 

Q.  You're  familiar  with  the  term  assumption  in  the 
intelligence  work  product? 

A.  Yes. 

Q.  And  what  would  you  call  when  would  you  call  something  an 
assumption? 

A.  When  you  don't  have  the  information,  but  you  think  it  might 
be  a  certain  way. 
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Q.  And  as  soon  as  you  actually  have  kind  of  actual  knowledge 
of  that  fact  would  you  call  it  an  assumption? 

A.  I  don't  understand  the  question. 

Q.  If  you  have  actual  knowledge  of  a  fact,  would  you  call 
something  an  assumption  in  a  work  product? 

A.  Facts  and  assumptions  are  separated. 

Q.  And  if  you  have  actual  knowledge  of  something  would  you 
call  it  an  intelligence  gap? 

A.  No. 

Q.  In  the  January  to  May  2010,  time  frame  did  your  unit  have 
any  actual  knowledge  as  to  which  websites  enemies  went  to  get 
information? 

A.  I  don't  remember. 

Q.  Did  you  ever  remember  anything  being  put  out  that  this 
particular  website  is  where  the  enemy  goes? 

A.  Like  their  own  websites  or  just  websites  in  general? 

Q.  The  latter. 

A.  General  knowledge  that  they  visit,  you  know,  all  sorts  of 
websites  seeking  information,  but. 

Q.  But  any  actual  knowledge  as  to  which  websites? 

A.  For  operational  security  purposes  they  —  you  know,  you're 
frequently  briefed  on  Facebook  and  social  networking  sites  that 
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obviously  a  lot  of  people  put  personal  information  on.  They've  used 
Google  maps. 

Q.  Potential  information  where  they  might  go? 

A.  Yes. 

Q.  Anything  where  there's  actual  confirmation  they  may  go  to 
this  website? 

A.  Not  that  I  know. 

Q.  Are  you  familiar  with  a  program  mIRC  Chat? 

A.  Yes. 

Q.  And  are  you  familiar  with  the  term  executable  file? 


Q.  How  was  mIRC  Chat  put  on  your  computer? 

A.  I  don't  remember. 

Q.  Was  it  —  when  you  say  you  don't  remember,  was  it  part  of 
your  computer  when  you  got  there? 

A.  No,  I  don't  think  so. 

Q.  How  did  you  use  mIRC  Chat  on  your  computer? 

A.  It  was  on  the  desktop.  The  icon  was  on  the  desktop. 

Q.  Did  you  have  to  click  on  it  —  double  click  it  to  get  it  to 

opened  up  and  run? 

A.  Yes. 

Q.  You  don't  recall  who  put  that  on  your  computer? 

A.  No. 
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Q.  Let's  discuss  the  SIGACTs  for  a  moment.  After  PFC 
Manning's  arrest,  did  your  unit  continue  to  use  SIGACTs? 

A.  Yes. 

Q.  Was  there  ever  a  time  in  which  your  unit  didn't  have  access 
to  the  Cl ONE  Iraq  database  that  had  SIGACTs? 

A.  No. 

Q.  Since  PFC  Manning's  arrest,  has  there  ever  been  anything 
put  out  that  says  don't  use  any  SIGACTs  that  predate  January  2010? 

A.  No. 

MJ:  Yes. 

ATC[CPT  WHYTE] :  Relevance. 

MJ:  Same  as  before,  641,  is  that  correct.? 

CDC [MR .  COOMBS]:  Yes,  Your  Honor. 

MJ:  Go  ahead. 

Questions  continued  by  the  civilian  defense  counsel  [MR.  COOMBS] : 

Q.  Did  you  and  the  other  analysts  continue  to  use  SIGACTs  that 
predated  January  2010,  in  the  same  way  that  you  did  after  PFC 
Manning's  arrest? 

A.  I'm  sorry,  are  you  asking  if  we  use  SIGACTs  from  before 
January  of  2010? 

Q.  In  the  same  manner  that  you  did  —  I'm  actually  asking 
before  PFC  Manning's  arrest  and  then  after,  did  you  change  the  way 
you  used  SIGACTs? 


7933 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


o 


A.  No. 

Q.  You  talked  about  the  Apache  video.  My  understanding  is 
when  you  came  back  and  you  said  you  didn't  think  that  was  the  same 
video  and  then  basically  you  told  PFC  Manning  to  prove  it  to  you  by 
sending  you  the  video? 

A.  No.  I  said  that  I  would  have  to  see  the  video  back  to  back 
in  order  to  be  able  to  make  that  determination,  because  I  had  seen 
both  video  clips,  I  had  seen  at  separate  times.  One  I  had  seen  not 
very  closely.  So  I  wasn't  sure  —  to  me  it  looked  like  they  weren't 
the  same  video,  but  again  I  was  just  saying  I  would  have  to  say  both 
videos  again  back  to  back  to  make  that  determination. 

Q.  And  after  saying  that  PFC  Manning  sent  you  the  video? 

A.  Correct. 

Q.  At  the  time  that  he  said  that  it  was  the  same  video  or 
after  sending  you  the  video,  did  he  act  in  any  way  that  was  boastful 
or  bragging  or  anything  like  that? 

A.  No. 

Q.  With  regards  to  just  analysts  in  general,  an  all  source 
analyst,  can  they  look  at  anything  they  want  to  on  the  SIPRNET? 

A.  Just  about,  yes. 

Q.  Would  you  discourage  an  all  source  analyst  from  basically 
from  basically  kind  of  like  surfing  the  SIPRNET  on  their  free  time 
just  to  see  what's  there  as  learning  information? 
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A.  No,  as  long  as  it  was  in  the  realm  of  professional 
development . 

Q.  Why  would  you  not  discourage  an  analyst  for  just  surfing 
the  SIPRNET? 

A.  Because  intelligence,  you  know,  and  enemy  threat  groups  are 
global.  So  although  we  have  a  mission  specific  enemy  that  we  should 
be  focused  on,  for  professional  development  purposes  they  could  learn 
about  other  enemy  threat  groups. 

Q.  So  if  you  saw  PFC  Manning  surfing  the  Internet  and  looking 
at  various  places  on  the  SIPRNET  and  pulling  information  just  kind  of 
organizing  it  for  his  professional  development,  you  wouldn't  have  a 
problem  with  that? 

A.  Yes.  For  his  professional  development,  no,  I  wouldn't. 

CDC [MR .  COOMBS]:  Thank  you. 

MJ:  Redirect? 

REDIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  WHYTE] : 

Q.  Captain  Fulton,  let's  just  talk  briefly  about  intelligence 
gap,  what  that  actually  means.  Can  you  give  maybe  just  an 
unclassified  example  of  what  could  be  an  intelligence  gap? 

A.  Frequently  intelligence  gaps  are  identified  during  the 
mission  analysis  portion  of  the  MDMP.  What  I  would  think  is  a  good 
example  of  an  intel  gap  is  frequently  is  the  enemy  logistics.  We 
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know  they're  bringing  weapons,  we  don't  know  where,  how,  or  when, 
we  make  some  assumptions  and  then  we  put  collection  assets  on  our 
assumptions  to  confirm  or  deny. 

Q.  So  you  know  the  enemy  is  bringing  in  weapons? 

CDC [MR.  COOMBS]:  Objection,  leading. 

MJ:  Overruled.  She  just  responded  to  that.  Go  ahead. 

[Examination  of  the  witness  continued.] 

Q.  So  you  know  that  the  enemy  is  bringing  in  weapons? 

A.  Yes. 

Q.  In  this  hypothetical? 

A.  Yes. 

Q.  What  else  do  you  know,  for  instance,  about  the  enemy  in 
this  hypothetical? 

A.  I  mean,  it  varies.  So  that's,  you  know,  they're  bringing 
them  in,  you  know,  that  they  have  to  be,  you  know,  coming  from 
somewhere.  They  have  to  be  doing  it  at  certain  times.  They  have  a 
methodology  associated  with  their  activities  and  you  may  not  know 
what  that  is  and  so  you  just  —  you  confirm  or  deny  in  order  to 
continually  fill  that  gap. 

Q.  And  just  lastly  on  cross  the  defense  asked  you:  Did  you 

ever  --  would  you  discourage  a  Soldier  from  surfing  the  SIPRNET? 

A.  For  professional  development  purposes? 

Q.  Yes.  Did  you  ever  surf  the  SIPRNET? 


So 
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A.  For  professional  development  purposes,  not  while  in 


theatre,  no. 


Q.  Why  not? 

A.  I  didn't  have  time. 

Q.  And  also  for  the  Apache  video,  you  said  you  were  surprised 
when  you  ended  up  seeing  it.  Why  were  you  surprised? 

A.  Because  what  I  had  seen  the  media  put  on  the  news  didn't 
look  at  all  like  the  same  when  I  saw  it. 

Q.  What  about  because  of  where  you  saw  it  previously? 

A.  Yes. 

ATC[CPT  WHYTE]:  No  more  questions.  Your  Honor. 

MJ:  All  right. 

CDC [MR.  COOMBS]:  Nothing,  Your  Honor. 

MJ:  Temporary  or  permanent  excusal?  Temporary? 

ATC [CPT  MORROW]:  Yes,  ma'am. 

[The  witness  was  duly  warned,  temporarily  excused  and  withdrew  from 
the  courtroom . ] 

MJ:  Counsel,  do  we  have  anything  else  to  present  today? 

CDC [MR.  COOMBS]:  No,  Your  Honor. 

TC [MAJ  FEIN]:  No,  Your  Honor. 

MJ:  As  I  announced  yesterday,  due  to  logistics  issues,  we're 

going  a  little  faster  than  we  anticipated  and  some  issues  that  the 
parties  need  to  work  logistically .  We're  going  to  put  the  Court  in 
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1  recess  until  0930  on  Monday  morning.  We'll  have  the  same  schedule 

2  that  we  have  been  having  all  along,  start  up  at  0930,  go  until  about 

3  --  we're  running  early  today,  but  5:30  or  6:00  in  the  afternoon. 

4  Is  there  anything  else  we  need  to  address? 

5  CDC [MR.  COOMBS]:  No,  Your  Honor. 

6  TC [MAJ  FEIN]:  No,  ma'am. 

7  MJ:  Court  is  in  recess. 

8  [The  court-martial  recessed  at  1512,  5  June  2013.] 


7938 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


o 


J 


[The  court-martial  was  called  to  order  at  0943,  10  June  2013.] 

MJ:  Court  is  called  to  order.  Major  Fein,  please  account  for 

the  parties. 

TC [MAJ  FEIN]:  Your  Honor,  all  parties  when  the  court  last 
recessed  are  again  present  with  the  following  exceptions:  Mr. 
Robertshaw,  Court  Reporter,  is  absent;  Mr.  Chavez,  Court  Reporter  who 
has  been  previously  sworn  is  present;  Captain  Overgaard  is  absent, 
and  Captain  Morrow  and  Captain  Whyte  are  present. 

MJ:  All  right.  Thank  you.  Let's  begin  with  any  housekeeping. 

Have  we  had  anything  marked  as  an  appellate  exhibit,  or  a  prosecution 
exhibit,  or  a  defense  exhibit? 

TC [MAJ  FEIN]:  Yes,  ma'am.  May  I  have  a  moment?  Your  Honor, 
first  the  parties  agreed  to  a  stipulation  of  expected  testimony  from 
Mr.  Steven  Buchanan,  dated  9  June  20133  and  this  has  been  marked  as 
Prosecution  Exhibit  69  for  Identification. 

MJ:  All  right.  PFC  Manning,  do  you  have  a  copy  of  Appellate 

Exhibit  69,  or  Prosecution  Exhibit  69,  I'm,  sorry  - 

ACC:  Yes,  Your  Honor. 

M J:  -  in  front  of  you?  And  we  have  had  this  discussion  on 

other  stipulations  of  expected  testimony  and  will  have  this 
discussion  probably  several  times  again  I  believe  in  the  course  of 
this  court-martial,  but  with  this  particular  stipulation  of  a  Mr. 
Steven  Buchanan  dated  9  June  2013,  it  consists  of  four  pages. 
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Is  that  your  signature  on  the  last  page? 

ACC:  Yes,  ma'am. 

MJ:  Before  signing  this  stipulation  did  you  read  it  thoroughly. 

ACC:  I  did.  Your  Honor. 

MJ:  Do  you  agree  with  the  contents  of  the  stipulation? 

ACC:  Yes,  ma'am. 

MJ:  Before  signing  this  stipulation,  did  your  defense  counsel 
explain  the  stipulation  to  you? 

ACC:  Yes,  ma'am. 

MJ:  Do  you  have  any  questions  about  the  stipulation? 

ACC:  No,  Your  Honor. 

MJ:  Do  you  understand  that  you  have  an  absolute  right  to  refuse 
to  stipulate  to  the  contents  of  this  document? 

ACC:  I  do.  Your  Honor. 

MJ:  Do  you  understand  you  should  enter  into  this  stipulation 
only  if  you  believe  it's  in  your  best  interest  to  do  that? 

ACC:  Yes,  Your  Honor. 

MJ:  And  once  again,  I  want  you  to  understand  how  this 
stipulation  is  going  to  be  used.  It's  a  stipulation  of  expected 
testimony,  and  what  that  means  is  when  counsel  for  both  sides  and  you 
agree  to  a  stipulation  of  expected  testimony,  you  are  agreeing  that 
if  Mr.  Steven  Buchanan  were  here  in  court  sitting  on  the  witness 
stand  that  Mr.  Buchanan  and  under  oath,  that  Mr.  Buchanan  would 
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testify  substantially  as  to  what  is  in  this  stipulation  of  expected 
testimony? 

ACC:  Yes,  Your  Honor. 

MJ:  All  right.  And  his  testimony  can  be  contradicted,  attacked 

or  explained  the  same  way  as  if  he  was  testifying  here  live  in  court, 
and  you  are  not  admitting  to  the  truth  of  the  person's  testimony? 

ACC:  Yes,  ma'am. 

MJ:  And  knowing  what  I  told  you  and  what  your  defense  counsel 

earlier  told  you  about  this  stipulation,  do  you  still  want  to  enter 
into  this  stipulation  of  expected  testimony? 

ACC:  Yes,  ma'am. 

MJ:  Counsel  for  both  sides  agree  to  the  stipulation  and  its 

content? 

TC [MAJ  FEIN]:  Yes,  ma'am. 

DC [MAJ  HURLEY] :  Yes,  ma'am. 

MJ:  All  right.  Prosecution  Exhibit  69  is  admitted. 

TC [MAJ  FEIN]:  Your  Honor,  also  on  5  June  2013  what  has  been 
marked  as  Appellate  Exhibit  564,  United  States  filed  its  witness  list 
order  and  proposed  stipulations  for  the  prosecution  witnesses  for  the 
remainder  of  the  government's  case  in  chief. 

MJ:  All  right.  As  I  understand  it,  the  parties  are  still 

working  on  some  of  those  stipulations? 
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TC[MAJ  FEIN]:  Yes,  ma'am.  Although  there  are  many  stipulations 
that  are  annotated  by  both  parties  on  this  filing,  we  are  working  and 
probably  the  next  recess  we'll  have  many  more  of  these  signed  and 
ready  for  the  court  to  go  over  with  the  accused. 

CDC [MR .  COOMBS]:  And,  Ma'am,  as  part  of  the  802  session  we 

discussed  that  if  the  government  were  to  add  anyone  on  to  this  list 
they  would  give  the  defense  a  24-hour  notice. 

TC [MAJ  FEIN]:  Yes,  ma'am.  And  the  United  States  acknowledges 

that . 

MJ:  All  right.  Any  other  housekeeping  matters? 

TC [MAJ  FEIN]:  Yes,  ma'am.  Ma'am,  as  of  this  morning  the  media 
operations  center  consists  of  11  journalists  and  two  stenographers. 
The  theater  is  not  currently  being  used.  And  the  overflow  trailer  is 
also  not  currently  being  used  although  available  and  up  to  30  seats. 

MJ:  All  right.  And  once  again,  for  the  record,  up  to  this 

point  in  time  at  the  trial  have  any  members  of  the  public  been 
specifically  excluded  based  on  the  Court's  order? 

TC [MAJ  FEIN]:  No,  ma'am. 

MJ:  All  right.  Thank  you.  Does  defense  have  any  reason  to 
disagree? 

CDC [MR.  COOMBS]:  No,  Your  Honor. 

MJ:  Any  other  matters  for  housekeeping? 

TC [MAJ  FEIN]:  No,  ma'am. 
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CDC [MR .  COOMBS]:  No,  Your  Honor. 

MJ:  All  right.  The  government  proposed  trial  schedule  plan,  I 

announced  at  the  beginning  of  the  trial  that  we  would  try  it  out  for 
a  week  and  see  how  it  worked.  We  had  a  little  fluctuation  last  week 
because  we  recessed  early,  but  that's  at  Appellate  Exhibit  551. 

There  was  no  defense  objection.  The  Court  will  approve  that  proposed 
trial  plan,  certainly  it  may  be  modified  as  we  go  along  depending  on 
necessity,  but  for  now  it  provides  a  good  rough  schedule  on  how  we 
will  proceed.  The  usual  starting  0930  in  the  morning,  ending 
approximately  15  —  or  at  5:30  or  6:00  o'clock  at  night  depending  on 
the  status  of  the  particular  witness  who  is  on  the  stand.  Any  issues 
with  Appellate  Exhibit  551? 

CDC [MR .  COOMBS]:  No,  Your  Honor. 

TC [MAJ  FEIN]:  No,  ma'am. 

MJ:  All  right.  Next  we  have  Appellate  Exhibit  563  and,  for  the 

record,  counsel  and  I  entered  into  a  R.C.M.  802  conference  this 
morning.  Once  again,  that's  a  conference  where  I  discuss  scheduling 
and  logistics  that  arise  in  cases.  One  of  the  issues  that  came  up 
was  any  changes  to  the  government's  witness  list  that  Mr.  Coombs  and 
Major  Fein  just  addressed.  Another  issue  that  came  up  was  Appellate 
Exhibit  563,  I  had  —  which  is  the  --  a  request  from  the  Freedom  of 
the  Press  Foundation  that  was  addressed  to  myself  and  Major  General 
Linnington  who  is  the  Commander  of  the  United  States  Military 
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District  of  Washington  with  respect  to  credentialing  two 
stenographers  to  —  an  overlap  of  two  stenographers  to  report,  to 
create  an  unofficial  transcript  of  this  trial  which  they  intend  to 
broadcast  that  will  be  available  to  all  media  outlets  and  the  public 
is  what  this  letter  tells  me.  Mr.  Coombs  advised  me  by  email  that 
the  defense  wished  to  put  their  position  on  the  record.  Would  you 
like  to  do  that? 

CDC [MR.  COOMBS]:  Yes,  Your  Honor.  Just  briefly.  We  believe 

that  this  enforces  PFC  Manning's  Sixth  Amendment  right  to  a  public 
trial  and  also  impacts  on  a  First  Amendment  right  for  the  press  to 
accurately  keep  track  of  what  happens  in  the  court-martial.  Our 
understanding  is  that  the  government  now  is  assuring  that  the 
stenographers  will  have  access  during  non-peak  times,  and  then  during 
peak  times  they  are  looking  into  whether  they'll  have  access  at  the 
MOC  or  not.  It  appears  that  regardless  of  whether  it's  peak  or  non¬ 
peak  they're  going  to  be  given  an  access  pass  instead  of  credential 
passes.  And  then  I  know  that  we  still  have  an  outstanding  issue  on 
whether  or  not  the  government  can  accommodate  the  request  to  have  one 
of  the  stenographers  come  in  at  0700  and  another  come  in  during  the 
afternoon  session  to  where  we  don't  have  a  requirement  for  both  of 
the  stenographers  to  be  present  the  entire  day. 

MJ:  All  right.  Major  Fein,  would  you  like  to  be  heard? 
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TC [MAJ  FEIN]:  Ma'am,  the  United  States  after  the  R.C.M.  802 
and  based  off  what  the  defense  has  asked  owes  the  Court  and  defense 
some  answers  to  questions.  One  is,  can  the  overflow  trailer  be  used 
as  an  area  for  a  stenographer  versus  the  media  operations  center  and, 
second,  the  logistics  of  actually  having  an  individual  escorted  on  or 
off  post  and  we'll  get  both  those  questions  answered  today.  Your 
Honor . 

MJ:  All  right.  Thank  you.  Just  for  the  record,  while  the 

Court  is  not  interested  in  getting  into  the  area  of  who  is 
credentialed  and  who  isn't  credentialed  as  it's  beyond  the  scope  of 
this  trial,  the  Court  does  note  and  so  advised  the  parties  in  the 
R.C.M.  802  conference  that  the  Rules  for  Court-Martial  are  not 
structured  to  provide  a  contemporaneous  transcript  of  proceedings. 

In  light  of  the  public  interest  in  this  case,  in  light  of  the  unique 
circumstances  of  this  case,  in  light  of  the  assertion  by  PFC  Manning 
that  this  stenographer  procedure  will  further  his  rights  to  a  Sixth 
Amendment  right  to  a  public  trial  and  also  obviously  further  the 
public's  First  Amendment  right  to  a  public  trial,  the  Court  has 
ordered  the  government  to  arrive  at  some  kind  of  accommodation  to 
allow  stenography  of  the  proceedings  of  this  trial  and  the  creation 
of,  I  guess  what  their  intent  is  an  unofficial  transcript,  certainly 
not  an  official  transcript,  the  government's  not  doing  it.  So  the 
government's  in  the  process  of  making  that  arise.  And  just  for  the 
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record,  this  rule  or  this  guidance  of  the  Court  can  always  be 
reconsidered  should  there  be  a  violation  of  the  Rules  of  Court  with 
respect  to  audio  broadcasting  or  visual  broadcasting  once  these 
procedures  are  put  into  place.  Does  either  side  desire  to  address 
this  issue  any  further? 

CDC [MR .  COOMBS]:  No,  Your  Honor. 

TC [MAJ  FEIN]:  No,  ma'am.  Ma'am,  before  we  go  on,  could  we 
please  correct  one  Appellate  Exhibit  for  the  record? 

MJ:  Certainly. 

TC [MAJ  FEIN]:  Earlier  the  Court  when  discussing  the 
government's  proposed  trial  schedule  plan  referenced  Appellate 
Exhibit  551.  The  actual  proposed  court  —  proposed  trial  schedule 
plan  is  553  Alpha. 

MJ:  All  right.  Does  the  defense  agree? 

CDC [MR .  COOMBS]:  I'll  have  to  take  Major  Fein's  word  for  it, 

ma'am,  I  don't  have  the  appellate  exhibits  in  front  of  me. 

MJ:  All  right.  553  Alpha  and  that's  the  government's  proposed 
trial  schedule  dated  21  May  2013.  Is  that  correct? 

TC [MAJ  FEIN]:  Yes,  Your  Honor. 

MJ:  Okay.  That's  the  Court's  mistake.  The  Court  is  prepared 

to  rule  on  the  request  for  public  access  or  in  the  alternative  motion 
to  intervene  to  vindicate  right  to  public  access. 
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On  3  June  2013,  the  Court  received  Appellate  Exhibit  558,  a 
proposed  motion  to  intervene  under  Rules  for  Court-Martial  806(a), 

(b)  and  (c)  by  three  individuals  who  are  not  parties  to  the  trial. 
Neither  the  government  nor  the  defense  have  moved  to  file  Appellate 
Exhibit  558  as  a  motion  with  the  Court. 

Findings:  One,  the  proceedings  have  been  open  to  the 
public  since  the  start  of  the  trial.  The  Court  has  made 
particularized  findings  as  required  by  R.C.M.  806(b) (2)  with  respect 
to  those  portions  of  the  trial  that  must  be  closed  to  protect 
classified  national  security  information,  Appellate  Exhibit  550. 

Two,  neither  the  Court  nor  anyone  acting  pursuant  to  order 
of  the  Court  has  specifically  excluded  any  person  from  observing  the 
proceedings  either  in  court  or  in  a  designated  overflow  area.  ' 

Three,  reasonable  policies  and  procedures  for  media 
registration  and  credentialing  have  been  established  and  published  by 
the  Military  District  of  Washington  as  set  forth  in  Appellate  Exhibit 
561. 

Four,  R.C.M.  806(c)  prohibits  photography  and  broadcasting 
to  include  video  and  audio  recording,  the  taking  of  photographs  and 
radio  and  televised  broadcasting  of  the  trial. 

Five,  the  two  parties  to  this  trial  are  the  United  States 
and  PFC  Manning.  Unless  authorized  by  the  Rules  for  Court-Martial, 
or  in  special  circumstances  recognized  by  the  Court  of  Appeals  for 
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the  Armed  Forces,  only  parties  to  the  trial  have  standing  to  file 
motions  to  be  considered  by  this  Court.  ABC  Inc.  v.  Powell,  Court  of 
Appeals  for  the  Armed  Forces,  1997. 

Ruling,  the  Court  declines  to  consider  Appellate  Exhibit 
558  as  it  is  from  three  individuals  who  are  not  parties  to  the  trial 
and  who  under  the  circumstances  lack  standing  to  file  a  motion  with 
the  Court.  I'll  have  this  marked  as  the  next  appellate  exhibit  in 
line . 

Is  there  anything  else  we  need  to  address  at  this  point 
before  going  forward  with  the  merits  of  the  trial? 

CDC [MR.  COOMBS]:  No,  Your  Honor. 

TC [MAJ  FEIN]:  No,  Your  Honor. 

MJ:  Government,  proceed. 

TC [MAJ  FEIN]:  Ma'am,  the  United  States  offers  Mr.  Buchanan's 
stipulation  to  be  read  into  the  record. 

MJ:  Proceed. 

TC [MAJ  FEIN]:  Stipulation  of  Expected  Testimony,  Mr.  Steven 
Buchanan,  9  June  2013.  It  is  hereby  agreed  by  the  accused,  defense 
counsel  and  trial  counsel  that  if  Mr.  Steven  Buchanan  were  present  to 
testify  during  the  merits  and  presentencing  phases  of  this  court- 
martial  he  would  testify  substantially  as  follows: 

I  work  as  a  contractor  for  the  National  Security  Agency, 
NSA.  I  provide  support  to  Intelink.  Intelink  is  a  software  suite 
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operating  on  U.S.  government  private  networks  which  provides 
Internet-like  services  to  enable  collaboration  between  intelligence 
agencies  within  the  United  States  Government.  Primarily  it  includes 
a  web-based  search  engine  of  Unclassified,  Secret  and  Top  Secret 
information  systems.  It  hosts  blogs  and  allows  for  messaging, 
sharing  files  and  searching  for  Unclassified,  Secret  and  Top  Secret 
information  across  agencies,  to  include  Intellipedia  for  online 
collaboration  and  passport  account  management. 

In  my  current  position  I  provide  security  for  Intelink  and 
serve  as  the  Information  Assurance  IA  manager.  This  means  that  I 
make  sure  the  systems  work  as  they  were  intended.  I  work  to  ensure 
the  systems  are  properly  maintained  and  guard  against  their  misuse.  I 
have  worked  in  this  role  for  5  years. 

Prior  to  holding  my  current  position  from  1999  to  2008,  I 
was  an  Information  Systems  Security  Engineer  for  Intelink.  In  this 
position  I  made  sure  the  systems  were  built  correctly  to  perform 
their  intended  connection,  search  and  storage  functions.  Before  that 
I  worked  in  systems  support  within  the  Intelligence  community,  IC. 

In  total  I  have  worked  in  the  IA  industry  supporting  different 
agencies  in  the  IC  since  1985. 

I  have  two  primary  IA  and  information  systems 
certifications  —  excuse  me  —  certifications.  First,  I  am  a 
Certified  Information  Systems  Security  Professional,  CISSP.  This 


7949 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


o 


a 


means  I've  heightened  experience  in  the  knowledge  of  information 
security.  CISSP  is  a  globally  recognized  standard  of  achievement 
that  confirms  an  individual's  knowledge  in  the  field  of  information 
security.  This  —  The  training  covers  all  parts  of  information 
security  including  personnel  and  building  securities  aspects.  CISSP 
indicates  that  an  individual  has  attained  specialized  knowledge  in 
the  field  of  IA  in  accordance  with  standards  articulated  and  in 
Department  of  Defense  Directive  8570.  In  addition  to  CISSP  I  also 
have  the  Information  Technology  Infrastructure  Library,  ITIL, 
foundation  certification.  ITIL  is  the  most  widely  adopted  framework 
for  IT  service  management  in  the  world.  ITIL  provides  a  framework  on 
technology  systems  management,  particularly  on  how  to  build 
information  management  systems  and  manage  them  with  a  specific 
process . 

In  my  role  as  an  IA  manager  for  Intelink,  I  am  familiar 
with  the  audit  logs  created  by  Intelink.  The  Intelink  System 
obtains,  manages,  and  stores  its  own  audit  data  through  the  course  of 
its  day-to-day  operations.  This  data  be  can  be  used  to  respond  to 
user  inquiries,  troubleshoot  technical  problems,  and  monitor  and 
maintain  Intelink  usage  and  performance.  These  logs  are  created 
anytime  anyone  makes  a  connection  with  a  computer  system.  The  system 
detects  these  connections  from  servers,  tracking  the  work  station 
making  the  request  of  the  system,  how  requests  route  through  the 
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system,  and  where  the  request  ultimately  gets  the  information.  These 
connection  logs  are  made  in  real-time  and  stored  in  data  files  every 
hour.  They  are  computer  generated  and  only  a  very  limited  number  of 
people  have  access  to  them.  Intelink  logs  contain  audit  data 
captured  from  proxy  servers  that  control  access  to  Intelink  services 
and  show  the  activities  of  users  in  that  connect  to  and  use  the 
Intelink  services  while  in  classified  and  unclassified  networks. 

We  know  that  Intelink  logs  are  accurate  for  several 
reasons:  First,  they  write  to  a  secure  server;  second,  only  limited 

personnel  have  access  to  them;  third,  they  are  reviewed  by  our  team 

at  least  on  a  weekly  basis  to  ensure  that  the  reporting  processes  are 
occurring  properly,  meaning  to  ensure  that  the  log  data  is  being 
written  properly.  The  log  data  is  useful  to  us  because  it  shows  us 
how  our  services  are  being  used,  whether  Intelink  services  are 
functioning  properly  and  whether  adjustments  should  be  made.  We  can 
also  use  the  data  to  solve  technical  issues,  determine  security  risks 
and  review  data  trends  that  help  us  develop  our  management 
strategies.  We  can  tell  if  there  are  errors  because  information  the 
logs  normally  collect  would  be  missing.  If  a  data  file  has  been 

corrupted  while  being  written,  it  would  not  open.  Missing  or 

corrupt  data  files,  excuse  me,  missing  or  corrupt  data  files  are 
regenerated  from  the  system,  so  in  short  the  data  these  systems  logs 
have  captured  is  complete  and  accurate. 
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I  am  involved  in  this  case  because  we  received  a  request  to 
pull  Intelink  audit  logs  given  Intelink  could  have  been  used  to 
gather  information  that  was  ultimately  compromised.  At  that  time  we 
did  not  track  users  by  log-in  identifiers.  Instead,  we  tracked  usage 
by  IP  address.  One  of  the  log  data  requests  was  from  the  Secret  or 
excuse  me,  ma'am.  Secure  Internet  protocol  routing  network,  SIPRNET , 
IP  address  22.225.41.22  and  22.225.41.40  from  October  2009  to  June 
2010.  Intelink  audit  logs  are  stored  on  a  Linux  based  system.  To 
pull  the  requested  log  I  performed  a  Linux  search  on  the  server. 

This  means  that  I  issued  a  line  command  telling  the  server  what 
information  I  wanted  to  read.  When  the  system  returns  the  data,  the 
system  writes  the  data  to  a  file.  In  reviewing  the  files  returned  I 
could  find  no  relevant  information  in  the  data  files  for  October  2009 
or  June  2010.  However,  there  was  activity  recorded  for  the  relevant 
IP  addresses  for  the  months  November  2009  through  and  including  May 
2010.  I  double-checked  to  make  sure  there  was  no  activity  from  the 
relevant  IP  addresses  during  October  of  2009,  and  then  ran  the  search 
again  to  verify  the  results.  The  results  of  the  second  search  match 
the  results  of  my  original  search.  The  results  are  saved 
automatically  as  a  .TXT  file  so  they  are  readable  to  the  person 
running  the  query.  When  I  received  the  response  to  my  IP  data  query, 
I  opened  the  file  to  make  sure  it  was  readable  and  that  all  the  data 
had  been  reported  properly.  I  did  not  alter  the  file  in  any  way.  I 
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burned  the  file  to  a  CD  and  then  turned  it  over  to  Special  Agent  Mark 
Mander  with  Army  CID.  These  logs  are  on  the  CDs  marked  Prosecution 
Exhibit  61  for  identification.  The  file  names  on  Intelink  logs  I 
have  attested  to  showing  activity  for  IP  addresses,  excuse  me,  IP 
address  22.225.41.22  are  the  following:  JF10_22.log,  MAM10_22.tex, 
and  ND09_22.log.  The  file  names  of  the  Interlink  logs  that  I 
attested  to  showing  activity  for  IP  address  22.225.41.40  are  the 
following:  JF10_40.log,  MAM10_40.txt,  ND09_40.log.  The  file 

JFlO_22.log  contains  audit  logs  capturing  data  for  the  22.225.41.22 
IP  address  in  January  and  February  2010.  The  file  MANl0_.txt 
contains  audit  log  —  audit  logs  capturing  activity  for  the 

22.225.41.22  IP  address  in  March,  April  and  May  2010.  The  file 
ND09_22.log  contains  audit  logs  capturing  activity  for  the  22.20  — 

225.41.22  IP  address  in  November  and  December  2009.  I  used  the  same 
file  name  structure  to  capture  the  contents  of  the  audit  logs 
associated  with  the  22.225.41.40  IP  address. 

The  particular  log  data  I  captured  reported  several  things. 
I  will  use  the  following  discrete  line  of  data  to  show  by  way  of 
example  what  the  Intelink  logs  mean.  Excuse  me.  Your  Honor. 
22.225.41.40 

29/November/2009: 05: 50: 10+0000\"GET/Intelink.WIP. ISMC.Sgov.gov/webres 
ource . AXT?D=AZ7KDRRCQCLTV13ZGP21NQ2&T=633627756757031250  HTTP/1 . 1"200 
—  excuse  me  200 
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6665"HTTP: //www. intelink. sgov. gov/search/dfault . ASPX?Q=HQDA" 
"Mozilla/5. 0%20 (Windows;  —  excuse  me.  Your  Honor, 

%20U; %20Windows%20NT%205 . 1 ; %20EN- 

US ; %20RV : 1 . 9 . 1 . 2 ) %20GECKO/20090729%20FIREFOX/3 .5.2)  (_) .  Excuse  me. 

Your  Honor,  -  not 

Paragraph  8.  The  significance  of  the  above  line  that  was 
pulled  from  Intelink  is  the  following:  The  "22.225.41.40"  is  the  IP 
address.  This  indicates  that  a  computer  with  the  IP  address  made  the 
request  for  information.  Essentially  it  provides  an  electronic 
location  for  the  user  using  Intelink.  The 

"29/November/200 : 04 : 50 : 10+0000"  is  a  date  time/group.  The  time  zone 
is  reflected  as  the  offset  from  the  Greenwich  Mean  Time,  GMT.  In 
this  case  "+0000"  shows  no  offset.  The  next  entry  is  the  action  the 
user  took.  In  this  case,  for  example,  you  see  "W  —  Excuse  me.  Your 
Honor,  you  see  "GET".  This  command  indicates  the  user  is  seeking 
particular  information  on  SIPRNET  through  Intelink.  The  action 
reflects  the  user  clicking  on  something  in  the  website.  The  next 
entry  is  the  web  page,  excuse  me,  the  page  being  requested  by  the 
action  above.  Here  it  is, 

"/Intelink. WIP . I SMC . sgov. gov/webre source . AXD?D=AZ7KDRRCQCLTV13ZGP21NQ 
2&T=63362776  —  excuse  me.  Your  Honor,  I'll  repeat  this  number  - 
633627756757031250  HTTP/1.2".  Intelink  .  —  WIP.ISC.sgov.gov  is  the 
registered  name  for  Intelink  which  is  on  the  SIPRNET,  a  Secret 
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government  system.  The  code  of  numbers  for  all  —  excuse  me,  for  the 
information  tells  you  whether  the  user's  request  was  successful  and 
to  what  degree.  For  example,  the  code,  "200",  after  particular 
information  indicates  that  an  Internet  home  page,  HTTP,  was 
successfully  accessed.  The  "6665",  is  the  size  in  bytes  of  the 
information  returned  by  the  query.  The  entry 

"HTTP : //WWW. Intelink. sgov. gov/search/default . ASPX?Q=HQDA"  tells  me 
the  user  searched  for  the  term,  "Head  --  HDQA"  on  Intelink.sgov.gov. 
"WWW.Inteling.sgov.gov"  in  the  SIPRNET  Internet  address  for  the 
Secret  government  system  on  which  Intelink  sits.  In  this  entry 
"search"  is  a  specific  Intelink  service  used  and  "Q=HDQA",  represents 
the  search  query  entered  into  the  search  box  on  the  Intelink  web  page 
on  the  specific  computer  with  the  IP  address  listed  above.  The 
entry,  "Mozilla/5 . 0",  tells  me  the  user  of  the  SIPRNET  computer  with 
an  IP  address  "22.225.41.40"  was  using  version  5  of  the  mozilla 
Internet  browser.  Mozilla  is  a  company  that  produced  Internet 
software  —  browser  software  similar  to  Microsoft  Internet  Explorer 
or  Apple  safari.  The  entry  %20  represents  a  space  in  the  line.  The 
entry,  "Windows ; %20U  — 

; %20Windows%20NT%205 . 1; %20EN/US; 20RV: 1 . 9. 1 . 6) ",  tells  me  the  user  of 
the  SIPRNET  computer  with  an  IP  address  of  "22.225.41.40"  was  using 
a  Windows  NT  work  station  computer.  The 

entry"%20gecko/20090729%20Firefox/3 .5.2"  "tells  me  that  the  user 
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of  the  SIPRNET  computer  with  an  IP  address  "22.225.41.40"  was  using  a 
version  of  the  Firefox  Internet  browser  version  number  "3.5.2". 
Firefox  is  a  specific  name  of  the  Internet  web  browser  program 
produced  by  the  mozilla  company. 

These  Intelink  logs  only  audit  what  happens  on  the  Intelink 
system,  so  it  can  only  tell  you  what  a  particular  user  IP  address  was 
doing  when  connected  with  the  Intelink  system.  It  would  reveal 
Intellipedia  searches  and  other  ways  the  user's  IP  address  used 
Intelink  searches  by  showing  what  files  within  Intelink  that  IP 
address  accessed.  At  the  time,  users  were  not  required  to  have 
Intelink  passport  accounts  to  use  most  Intelink  services,  including 
the  SIPRNET  Internet  search  and  browsing.  A  SIPRNET  Intelink 
passport  account  is  a  user  name  and  password  account  established  to 
allow  access  to  some  government  websites.  It  is  one  of  the  many 
applications  Intelink  uses  on  its  own  internal  systems  to  track  what 
a  user  accesses.  A  user  would  need  an  account  if  he  wanted  to 
contribute  to  Intelink  services  or  access  certain  websites  or 
databases  on  SIPRNET,  but  not  just  to  conduct  searches.  To  create  an 
account  a  user  would  have  to  be  on  the  SIPRNET,  go  to  the  account 
creation  page  and  insert  personal  information  such  as  name,  contact 
and  organizational  information.  The  user  is  then  notified  via 
SIPRNET  email  with  a  code  to  use  the  first  time  he  accesses  the  site. 
Other  government  organizations  or  websites  and  databases  on  SIPRNET 
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use  SIPRNET  Intelink  passport  accounts  to  verify  users  before  any 
user  may  access  their  information  on  SIPRNET.  Our  Intelink 
organization  maintains  and  stores  Intelink  passport  account  profiles 
of  registered  Intelink  users.  In  a  response  to  a  request  by  Army  CID 
I  looked  Bradley  Manning  up  in  our  system.  Someone  with  the  name, 
"Manning, Bradley  E"  did  have  an  account.  The  user  name  of  the 
individual  was,  "Bradley . E . Manning" .  According  to  the  user  account, 
"Bradley. E. Manning",  was  in  the  military.  His  pay  rate  was  E4  and 
used  an  email  address  of  "Bradley.Manning@US.Army.smil.mil."  The 
user  name  is  automatically  generated  based  on  a  common  name  used  by 
the  individual  setting  up  the  account.  The  user  information  includes 
identifies  each  identifying  factor  such  as  name,  contact  information 
security  questions  and  answers.  That  the  user  inputed  into  the 
system  at  the  time  the  account  —  of  the  account  creation.  According 
to  the  passport  account,  the  last  time  the  user  logged  in  was  27 
April  2010  at  1805  and  46  seconds  Zulu  time.  According  to  the 
passport  account  the  registration  date  was  11  October  2008.  The 
password  account  information  is  marked  as  PE  62  for  Identification. 

I  signed  an  attestation  on  22  June  2010,  Bates  Number  00505257 
attesting  to  the  authenticity  of  what  have  been  marked  as  PE  61  and 
PE  62  for  Identification  and  are  the  provided  logs  in  the  Intelink 
password  account  information  for  "Bradley . E . Manning"  contained  in  the 
file  "Manning . LDIV" . 
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Your  Honor,  the  United  States  moves  to  admit  Prosecution 
Exhibit  61  and  62  for  Identification  as  Prosecution  exhibit  61  and 
62. 

DC [MAJ  HURLEY]:  No  objection,  ma'am. 

MJ:  All  right.  May  I  see  —  Is  Prosecution  Exhibit  61  a  CD? 

TC [MAJ  FEIN]:  Your  Honor,  Prosecution  Exhibit  61  is  two  CDs. 

CD  1  of  2  and  2  of  2 .  And  62  is  a  printout.  Your  Honor,  may  I  have 
a  quick  moment? 

[There  was  a  brief  pause  while  the  trial  counsel  consulted  with 
assistant  trial  counsel.] 

MJ:  Yes.  All  right.  Prosecution  Exhibits  61  and  62  are 

admitted.  Handing  it  back  to  the  court  reporter. 

Government,  are  you  ready  to  proceed? 

TC [MAJ  FEIN]:  Yes,  ma'am. 

ATC [CPT  MORROW]:  Your  Honor,  the  United  States  recalls 

Special  Agent  David  Shaver. 

[END  OF  PAGE] 
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SPECIAL  AGENT  DAVID  SHAVER,  U.S.  Army,  was  recalled  as  a  witness  for 
the  prosecution,  was  reminded  he  was  still  under  oath,  and  testified 
as  follows : 

DIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  Special  Agent  Shaver,  you  are  still  under  oath. 

A.  Yes,  sir. 

Q.  Agent  Shaver,  I  want  to  begin  by  talking  about  some  SIPRNET 
Intelink  logs  collected  as  part  of  this  case,  but  first  I  need  to  ask 
a  few  preliminary  questions.  Did  you  examine  any  SIPRNET  computers 
associated  with  PFC  Manning  as  part  of  this  investigation? 

A.  Yes,  sir,  I  did. 

Q.  And  what  were  the  IP  addresses  of  those  computers? 

A.  They  were  ending  in  .22  and  .40. 

Q.  And  again  for  the  record,  what  is  an  IP  address? 

A.  That's  like  a  telephone  number  for  a  computer. 

Q.  And  are  you  familiar  with  Intelink? 

A.  Yes,  sir,  I  am. 

Q.  And  what  is  Intelink? 

A.  It's  Google  of  the  SIPRNET. 

Q.  And  did  you  examine  any  logs  collected  from  the  SIPRNET 
Intelink  site  in  this  case? 

A.  Yes,  sir,  I  did. 
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Q.  And  what  did  those  logs  contain  generally? 

A.  They  generally  contained  the  source  IP,  the  computer  making 
the  request,  date  and  time  of  the  request  and  some  of  the  search 
list . 


Q.  Now,  were  the  Intelink  logs  you  examined  all  of  Intelink  or 
was  it  just  associated  with  a  particular  IP? 

A.  Sure,  they  were  just  associated  with  .22  and  .40. 

Q.  And  what  time  period  roughly  did  those  —  the  logs  cover? 

A.  November  2009  to  May  2010. 

Q.  And  why  was  that  time  period  collected  as  part  of  this 

case? 


A.  Sir,  that's  when  PFC  Manning  was  in  theater. 

Q.  When  you  received  the  log  files,  what  do  you  do;  do  you 

work  off  that  copy  or  do  you  work  off  another  copy? 

A.  Sir,  for  ease  of  review  I  generally  —  for  this  case  I  took 
them  and  converted  them  to  an  Excel  spreadsheet  for  ease  of  review. 

Q.  Okay.  So  let's  just  back  up  a  little  bit  though.  In  what 
form  did  you  receive  the  log  files? 

A.  They  were  text  files. 

Q.  And  what  is  a  text  file? 

A.  Sir,  it's  just,  just  raw  text,  unformatted. 

Q.  And  so  what  did  you  do  once  you  found  or  at  least  opened 
the  files  and  they  were  text  files,  what  did  you  do  next? 


7960 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


J 


A.  I  imported  them  into  Excel. 

Q.  And  generally  why  do  log  files  come  to  you  in  text,  is  that 
standard? 

A.  Yes,  sir,  generally. 

Q.  And  why  is  that? 

A.  Sir,  it's  just  for  ease  of  transferring  information  between 
one  —  for  review  and  ease  of  transferring  the  data  from  one  computer 
to  another.  Text  is  a  common  format  for  that. 

Q.  Okay.  And  when  you  received  the  log  files  in  text,  if  you 
had  printed  those  text  files  —  first  let  me  ask  this  question.  Was 
it  one  big  file  or  several  small  file  files? 

A.  There  are  several  smaller  files. 

Q.  If  you  had  printed  just  one  of  those  files,  approximately 
how  many  pages  would  that  have  come  out  to? 

A.  Quite  a  lot.  Maybe  a  hundred  or  so,  if  not  more. 

Q.  And  that's  just  for  one  log  file? 

A.  I  believe  —  Yes,  sir. 

Q.  Now,  you  said  you  converted  these  text  files  into  Excel? 

A.  Yes,  sir. 

Q.  And  once  they  were  converted,  if  you  had  printed  that 
entire  log  sheet  essentially  or  all  the  logs  for  the  time  period,  how 
many  pages  are  we  talking  about? 

A.  A  lot.  Several  hundred,  if  not  more. 
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Q.  And  in  your  line  of  work,  do  you  regularly  transfer  text 
files  from  just  their  native  format  to  Excel? 

A.  Yes,  sir. 

Q.  And  is  that  a  difficult  process? 

A.  No,  sir. 

Q.  And  when  you  transfer  the  information  from  text  to  the 
Excel  spreadsheet,  did  you  alter  the  information  in  any  way? 

A.  No,  sir. 

Q.  All  right.  So  let's  talk  about  the  logs  in  their  —  in  the 
Excel  format.  Once  you  had  them  in  that  format,  what  did  you  do 
next? 

A.  I  wanted  to  determine  since  this  is  Google  basically,  I 
wanted  to  determine  what  keywords  were  used,  what  was,  what  keywords 
were  entered  and  what  was  searched. 

Q.  And  how  do  you  determine  based  on  looking  at  the  logs  what 
searches  were  made  from  these  computers? 

A.  What  I  did  is  I  went  to  Intelink  on  my  SIPRNET  computer  and 
I  did  some  keyword  searches  and  then  I  requested  my  Intelink  logs 
from  my  SIPRNET  computer. 

Q.  Now,  when  you  say  you  requested  your  Intelink  logs,  did  you 
have  to  go  somewhere  else  to  ask  for  - 

A.  I  had  to  put  a  request  in.  Yes,  sir. 

MJ:  Just  a  moment.  Yes. 
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ADC [CPT  TOOMAN] :  Your  Honor,  if  the  government  would  like  to 

introduce  the  logs  that  Agent  Shaver  made,  the  defense  will  stipulate 
to  that. 

MJ:  You  are  laying  a  foundation? 

ATC [CPT  MORROW]:  I  need  to  explain  to  the  court  essentially 

what  they  are. 

MJ:  That's  fine.  Go  ahead. 

Q.  So,  again,  start  the  process  of  finding  a  search.  How  would 
you  find  a  search? 

A.  Yes,  sir.  So  I  found  the  keywords  that  I  searched  for  and 
then  I  went  to  the  logs  and  determined  there  was  a  specific  pattern 
that  predates  before  the  search,  so  once  I  figured  out  what  the 
pattern  is,  the  keyword  followed  it  and  I  filtered  it  off  of  that. 

Q.  So  you  used  the  pattern  to  then  filter  off  the  logs  that 
you  had  already  collected? 

A.  Correct. 

Q.  And  once  you  had  that  pattern  identified  in  the  raw  logs 
essentially,  what  did  you  do  next? 

A.  I  extracted  all  the  keywords  out  as  a  separate  tab  on  the 
Excel  spreadsheet  and  then  I  started  looking  at  what  keywords  were 
entered. 

ATC [CPT  MORROW]:  I  am  retrieving  Prosecution  Exhibit  81  for 

Identification  from  the  court  reporter. 
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Q.  Agent  Shaver,  if  I  could  have  you  move  to  the  panel  box, 
please . 

A.  Yes,  sir. 

ATC [CPT  MORROW]:  Your  Honor,  this  exhibit  already  been  shown 

to  defense  counsel. 

MJ:  All  right.  Thank  you.  I  notice  Captain  Tooman  nodding  his 

head. 

ADC [CPT  TOOMAN]:  Yes,  ma'am. 

ATC [CPT  MORROW]:  I  am  handing  the  witness  what  has  been 

marked  as  Prosecution  Exhibit  81  for  Identification. 

Q.  Agent  Shaver,  if  you  could  just  take  a  moment  and  look  at 
you  that,  please.  Agent  Shaver,  do  you  recognize  that  document? 

A.  Yes,  sir,  I  do. 

Q.  And  what  is  it? 

A.  Sir,  this  is  the  keywords,  the  spreadsheet  that  I  created 
that  contains  the  keywords. 

Q.  When  you  say  keywords,  again,  what  does  that  mean  for  — 
What  kind  of  activity  is  that  capturing  from  the  Intelink  logs? 

A.  Sir,  if  you  went  to  the  Intelink,  it's  a  website,  if  you 

went  there  and  you  would  put  a  keyword  in,  cat,  dog,  it  would  log 
that,  the  word  cat,  and  that's  what  I  did  was  I  pulled  out  those 
individual  searches.  So  you,  again,  this  is  —  go  to  the  website, 
put  in  a  keyword  and  hit  enter. 
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Q.  And,  Agent  Shaver,  did  you  create  that  document? 

A.  Yes,  sir. 

Q.  And,  again,  is  that  an  accurate  summary  of  all  of  the 
Intelink  searches  on  the  SIPRNET  from  these  two  user  accounts? 

A.  Yes,  sir.  The  two  computers,  sir. 

Q.  The  two  computers,  .22  and  .40? 

A.  Yes,  sir. 

Q.  And  when  you  extracted  the  searches  from  the  full  logs,  did 
you  alter  the  information  in  any  way? 

A.  I  extracted  out  the  information,  but  I  did  not  alter. 

ATC [CPT  MORROW]:  Your  Honor,  at  this  time  the  prosecution 

moves  to  admit  Prosecution  Exhibit  81  for  Identification  into 
evidence. 

ADC [CPT  TOOMAN] :  No  objection.  Your  Honor. 

MJ:  May  I  see  it,  please?  Prosecution  Exhibit  81  for 

Identification  is  admitted. 

ATC [CPT  MORROW]:  I'm  going  to  hand  the  exhibit  back  to  the 

witness  to  ask  a  few  questions. 

Q.  Agent  Shaver,  can  you  generally  just  describe  the 
information  and  the  columns  just,  you  know,  the  headers  essentially 
left  to  right. 

A.  Sure.  Yes,  sir.  The  first  field  would  be  a  number  field, 
that's  something  I  put  in  there  to  make  it  easier  so  you  can 
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reference  the  numbers.  Number  2  --  The  next  field  is  IP  address. 

The  next  field  is  the  date  and  time.  The  next  field  is  the  time 
zone.  And  the  action,  the  keyword  that  was  entered. 

Q.  Now,  when  you  say  date,  I'm  sorry,  when  you  say  date  and 
time,  what  do  you  mean  by  that,  the  date  and  time  something  was 
searched? 

A.  Yes. 

Q.  And  when  was  the  first  search  by  either  one  of  those 
computers? 

A.  It  would  be  10  November  2009. 

Q.  And  when  was  the  last  search? 

A.  7  May  2010. 

Q.  And  I  want  to  talk  about  —  actually,  first,  let  me  just 
ask  this  question.  When  was  the  first  search  for  WikiLeaks  in  those 
—  in  that  summary? 

A.  1  December  2009. 

Q.  And  are  there  any  other  searches  based  on  your  review  of 
those  searches  that  you  thought  were  of  interest  to  the  investigation 
or  odd  in  any  way? 

A.  Yes,  sir.  There  were  several  that  were  odd,  searches  for 
things  like  Iceland  and  Julian  Assange,  they  seemed  out  of  place. 

Q.  And  why  do  you  say  that? 
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A.  Sir,  it  is  my  understanding  these  computers  were  at  FOB 
Hammer  Iraq  and  should  have  been  focused  on  events  in  and  around  FOB 
Hammer  Iraq. 

ATC [CPT  MORROW]:  Thank  you.  I'm  retrieving  Prosecution 

Exhibit  81.  Agent  Shaver,  you  can  move  back  to  the  witness  box. 

Thank  you. 

Q.  Agent  Shaver,  I  want  to  talk  about  some  of  the  searches  for 
WikiLeaks  and  where  they  led  on  the  SIPRNET .  What  happens  when  the 
user  at  one  of  the  IP  addresses  searches  for  WikiLeaks,  what  comes 
back  in  the  log? 

A.  There  would  be  some  search  hits.  If  the  user  then  clicks 
on  log  files  or  clicks  on  a  link,  it  will  show  that  link  has  been 
clicked  and  things  of  that  nature. 

Q.  Now,  in  this  case  at  least  for  these  SIPRNET  Intelink  logs, 
does  the  activity  after  the  search,  is  that  always  captured? 

A.  No,  sir. 

Q.  And  why  would  sometimes  there  be  gaps,  sir? 

A.  If  the  user  went  to  a  web  page,  entered  Intelink,  entered  a 
search  term  and  it  was  directed  to  a  new  web  page,  in  essence  they're 
now  on  that  web  server,  no  longer  part  of  the  Intelink  world. 

Q.  Okay.  I'm  retrieving  what's  been  marked  as  Prosecution 
Exhibit  45  for  Identification. 

MJ:  Captain  Tooman? 
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ADC [CPT  TOOMAN] :  I'm  just  standing  up  to  look  at  it.  Your 

Honor . 

ATC [CPT  MORROW]:  I'm  handing  the  witness  what  has  been  marked 

as  Prosecution  Exhibit  45  for  Identification.  Agent  Shaver,  just 
take  a  look  at  that,  please. 


Q. 

Do  you  recognize  that  document? 

A. 

Yes,  sir,  I  do. 

Q. 

And  what  is  it? 

A. 

It's  the  Army  Counter  Intelligence  Center  report  on 

WikiLeaks 


Q. 

And  was  this  document  accessible  via  the  SIPRNET? 

A. 

Yes,  sir. 

Q. 

And  based  on  your  review  of  the  Intelink  logs,  did  any 

searches 

for  WikiLeaks  lead  to  the  discovery  or  the  access  of  this 

document  on  the  SIPRNET? 


A. 

Yes,  sir. 

Q. 

And  how  did  you  go  about  identifying  this  particular 

document 

in  the  Intelink  logs? 

A. 

This  document  was  provided  to  me  for  examination  to  compare 

against  a  document  which  was  released  by  WikiLeaks,  and  the  original 


document 

that  was  provided  to  me  a  unique  name  was  provided. 

Q. 

So  it  wasn't  titled  at  least  whatever  the  title  of  the 

document 

was? 
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A.  No,  sir. 

Q.  Do  you  recall  at  least  what  the  title  was? 

A.  It  started  with  RB08  and  there  were  some  numbers  after 

that . 

ATC [CPT  MORROW]:  Okay.  I  am  retrieving  Prosecution  Exhibit 

45  for  ID  from  the  witness  and  I  am  retrieving,  again.  Prosecution 
Exhibit  84  for  Identification  from  the  court  reporter.  I  am  handing 
the  witness  what  has  been  marked  as  Prosecution  Exhibit  84  for 
Identification  to  the  witness. 

Q.  Agent  Shaver,  do  you  recognize  that  document? 

A.  Yes,  sir,  I  do. 

Q.  And  what  is  it? 

A.  This  is  another  document  I  created  based  upon  the  searches 
for  that  RB  document  from  the  Intelink  logs. 

Q.  So  what  does  that  document  show  essentially? 

A.  It  shows  four  different  times  in  which  the  IP  .40  viewed  or 
attempted  to  view  the  RB  document . 

ATC [CPT  MORROW]:  Okay.  I'm  retrieving  —  Permission  to 

publish  to  the  court.  Your  Honor? 

MJ:  Proceed. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
Prosecution  Exhibit  84  to  the  Court.] 
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Q.  Agent  Shaver,  I  want  to  start  with  line  1.  Can  you  just 
describe  for  the  Court  the  activity,  the  action  on  the  very  far 
right,  please? 


A. 

Yes,  sir.  You  see  the  last  —  how  do  you  clear  it? 

Q. 

Don't  worry  about  that. 

A. 

Okay. 

Q. 

You  can  just  describe  the  box  there. 

A. 

Okay.  The  line  I've  managed  to  —  there  you  go.  Thank 

you,  sir. 

The  last  line  there  you  see  it  says 

HTTP /WWW. 

Intelink.S. gov/search/default,  and  it's  Q=WikiLeaks,  that's 

a  —  that  was  the  search  query  for  this,  the  search  terms  WikiLeaks 
was  used,  and  these  are  the  —  the  result  was  this  document.  And  if, 
again,  if  you  look  at  that  third  from  the  bottom  it  says  the  address, 
AKIKA.north-INSCOM.Army.smil.mil,  a  little  further  down  you  see  the 
document  itself,  RB08-617 . ASP,  and  a  little  further  to  the  right  you 
see  where  it  says  200  and  then  there's  numbers  at  the  end.  The  200 


means  it' 

1 s  successful,  this  document  was  viewed. 

Q. 

Okay.  And  what's  a  .ASP? 

A. 

That's  like  a  web  page. 

Q. 

Okay.  In  lines  2,  3,  and  4  do  you  see  the  —  is  there  also 

a  successful  access  in  those  cases? 
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A.  No,  sir.  The  302  it's  a  redirect,  so  at  this  time  if  they 
clicked  on  that  link  looking  for  that  specific  document,  it  went 
somewhere  else. 

Q.  Okay.  So  you  can't  tell  if  that  was  successful  access  of 
that  document? 

A.  No,  sir. 

Q.  Now,  again,  in  at  least  this  summary,  what,  which  line  is 
the  successful  access  versus  the  unsuccessful? 

A.  It  would  be  the  first  one,  sir. 

Q.  And  what's  the  date  of  that  search? 

A.  29  December  2009. 

Q.  Thank  you. 

M J :  My  understanding  the  29  December  2009,  was  successful  and 
the  other  three  were  not? 

WIT:  They  may  have  been,  therein  lies  the  permutation  of  the  log 
files.  It  meant  if  you  click  on  the  link,  it  may  have  —  it 
redirected  it  to  somewhere  else  and  I  don't  know  where. 

MJ:  Thank  you. 

WIT:  So  it  may  have  been. 

ATC [CPT  MORROW]:  Your  Honor,  at  this  time  the  prosecution 

moves  to  admit  Prosecution  Exhibit  84  for  Identification  into 
evidence . 

ADC [CPT  TOOMAN] :  No  objection.  Your  Honor. 
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MJ:  All  right.  Prosecution  Exhibit  84  is  admitted. 

Q.  Agent  Shaver,  I  want  to  talk  about  the  Intelink  searches  in 

the  14  February  2010  timeframe.  First,  based  on  your  review  of  the 
searches  in  these  logs,  did  the  logs  capture  any  searches  for 
WikiLeaks  on  14  February  2010? 

A.  Yes,  sir,  I  believe  they  did. 

Q.  And  generally  again  where  did  these  searches  lead  on  the 
SIPRNET? 

A.  To  websites  that  have  information  pertaining  to  WikiLeaks. 
ATC [CPT  MORROW]:  I'm  retrieving  what's  been  marked  as 

Prosecution  Exhibit  85  for  Identification. 

Q.  Agent  Shaver,  I'm  handing  you  Prosecution  Exhibit  85  for 
Identification. 

A.  Yes,  sir. 

Q.  Just  take  a  moment  and  look  at  it,  please. 

ATC [CPT  MORROW]:  I'm  retrieving  Prosecution  Exhibit  85  for 

Identification  with  the  witness.  May  I  have  permission  to  publish. 
Your  Honor. 

MJ:  Go  ahead. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
Prosecution  Exhibit  85  for  Identification  to  the  Court.] 
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Q.  Agent  Shaver,  I  won't  go  through  all  the  lines  in  this 
document,  but  could  you  just  describe  for  the  Court  what  this,  first 
of  all,  again,  what  is  the  document? 

A.  Again,  this  is  a  subset  of  the  Intelink  logs  for  February 
14th,  2010. 

Q.  And  where  does  this  subset  of  logs  begin,  what's  the  first 
action? 

A.  Again,  it's  another  search  for  WikiLeaks,  you  can  see  that 
from  the  top  line  under  the  Q=WikiLeaks,  and  this  search  ended  up  on 
an  Army  website. 

Q.  Can  you  just  point  out  the  line,  please? 

ATC [CPT  MORROW]:  It  might  be  easier  if  I  just  hand  it  back  to 

the  witness. 

A.  Yes.  I'm  sorry,  it's  a  little  blurry  on  here. 

Q.  Were  you  able  to  —  Based  on  your  review  of  the  logs,  were 

you  able  to  identify  any  documents  accessed  by  the  user  of  those  IP 
addresses  in  the  logs? 

A.  Yes,  sir. 

Q.  And  what  documents  were  you  able  to  identify  as  being 
accessed? 

A.  There  is  one  called  CCCHereBeDragonsTripReport . 

Q.  And  what  line  is  that  in  that  summary? 

A.  12. 
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Q.  And  were  there  any  other  documents  accessed  as  a  result  of 
this  search  on  Intelink? 

A.  There  is  an  HR  as  well,  following  a  bunch  of  numbers, 
classified  documents  on  WikiLeaks  .PDF. 

Q.  And  based  on  your  review  of  the  Interlink  logs  generally, 
have  you  ever  seen  this  document  accessed  at  a  previous  time  other 
than  February  14th? 

A.  Yes,  sir. 

Q.  And  what  timeframe  was  that? 

A.  I  believe  it  was  early  December. 

Q.  Agent  Shaver,  I  just  want  to  —  who  created  this  document? 

A.  I  did. 

Q.  And  how  did  you  create  it? 

A.  Sir,  it  was  just  filtered  on  the  date  for  February  14th. 

ATC [CPT  MORROW]:  Your  Honor,  at  this  time  the  prosecution 

moves  to  admit  Prosecution  Exhibit  85  for  Identification  into 
evidence . 

ADC [CPT  TOOMAN] :  No  objection. 

MJ:  May  I  see  it,  please? 

Q.  Agent  Shaver,  I  want  to  shift  gears  for  a  moment.  Other  than 
searches  made  from  the  computers  on  Intelink,  what  other  activity  was 
significant  that  you  observed  in  the  Intelink  logs? 
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A.  There  were  a  number  of  hits  —  there  were  a  number  of 
downloads  using  the  WGet  utility. 

Q.  And  what  is  WGet? 

A.  Sir,  that  is  a  command  line  program  executable  designed  to 
basically  download  files  from  web  pages. 

Q.  And  when  you  say  something's  a  command  line  program,  what 
do  you  mean  by  that? 

A.  It's  command  line,  so  there  is  not  a  graphical  user 
interface.  There's  no  need  for  a  mouse.  You  have  to  type  the 
commands  in  from  the  command  prompt.  So  if  you  were  to  go  to,  you 
have  a  Windows  computer,  if  you  go  to  start,  run,  type  CMD,  and  hit 
enter,  that  will  be  a  DOS,  a  little  black  window  would  open  and  that 
would  be  command  window.  You  could  then  type  commands  from  there. 

Q.  Now,  is  WGet  —  what  is  it,  is  it  software? 

A.  Yes,  sir. 

Q.  And  you  also  said  something  about  executable.  What's  an 
executable? 

A.  It's  just  a  program  that  runs. 

Q.  And  what's  the  difference  between  software  and  executable? 

A.  Same  thing,  sir. 

Q.  It's  just  exactly  basically? 

A.  Yeah. 
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Q.  Now,  based  on  your  knowledge  and  experience,  is  WGet  a 
standard  program  on  Army  computers? 

A.  Not  Windows  computers,  no,  sir. 

Q.  Why  do  you  say  that? 

A.  Sir,  part  of  our  mission  at  CCIU  was  to  find  malware  on  a 
computer,  so  we  had  access  to  the  Army  Gold  Master.  And  the  Army 
Gold  Master  or  AGM  is  how  the  Army  distributes  software  to  include 
Office  and  operating  systems  themselves  across  the  Army  network.  So 
we  had  access  to  that.  We  would  use  that  to,  once  you  know  what's 
supposed  to  be  there,  it's  easier  to  figure  out  what's  not  supposed 
to  be  there. 

Q.  All  right.  Let's  talk  about  the  presence  of  WGet  in  the 
logs.  Do  you  recall  the  first  example  of  WGet  in  the  logs? 

A.  I  believe  it  was  March  2010. 

ATC [CPT  MORROW]:  I  am  retrieving  what's  been  marked  as 

Prosecution  Exhibit  83  for  Identification.  I'm  now  showing  them  to 
defense  counsel.  I'm  handing  the  witness  what  has  been  marked  as 
Prosecution  Exhibit  83  for  Identification. 

Q.  Agent  Shaver,  could  you  take  a  moment  and  look  through 
that,  please? 

A.  Yes,  sir. 

Q.  Do  you  recognize  that  document? 

A.  Yes,  sir,  I  do. 
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Q.  And  what  is  it? 

A.  Sir,  this  is,  again,  this  is  a  filtered  on  WGet  from  March 
7th  from  the  Intelink  logs. 

Q.  And,  again,  when  you  say  you  filtered,  so  you  created  that 
document? 

A.  Yes,  sir,  I  did. 

Q.  And  when  you  created  the  document,  did  you  alter  the 
information  in  any  way  from  the  original  logs? 

A.  No,  sir. 

Q.  So  what  was  the  filter  you  used  to  sort  of  create  that 
summary? 

A.  Basically  WGet  and  on  March  7th. 

Q.  And  what  does  that  document  show,  just  generally,  and  I'll 
—  in  a  moment  we’ll  go  through  it,  but  just  generally  what  does  it 
show? 

A.  Sir,  it  shows  a  large  number  of  files  being  downloaded  in 
an  automated  fashion. 

Q.  And  when  is  the  date  of  the  first  download  of  a  document 
using  WGet? 

A.  That  would  be  March  7th,  2010. 

Q.  What  time? 

A.  3:18. 
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Q.  And  when  is  the  last  action  of  downloading  using  WGet  in 
the  logs? 

A.  Last  action  is  March  7th,  2154. 

Q.  2154? 

A.  I'm  sorry.  Your  —  I'm  sorry.  7:06,  I  apologize. 

Q.  So  approximately  between  the  first  and  last  action,  how 
much  time  elapsed? 

A.  Just  a  few  hours. 

MJ:  Wait  a  minute.  Let  me  stop  you  there.  So  the  first 

download  is  7  March  at  3:18  and  the  second  one  is  7  March  at  when,  or 
the  last  one? 

WIT:  The  last  one,  I  apologize,  ma'am,  7:06. 

MJ:  Using  military  time  or  using  civilian  time? 

Q.  This  might  be  easier  —  Agent  Shaver,  let's  just  go  through 

it. 

A.  No  problem. 

ATC [CPT  MORROW]:  Permission  to  publish  to  the  Court,  Your 

Honor. 

WIT:  Ma'am,  military  time. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
Prosecution  Exhibit  85  for  Identification  to  the  Court.] 

ATC [CPT  MORROW]:  I'm  just  going  to  show  the  first  page  of 

this  exhibit.  Your  Honor. 
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Q.  Agent  Shaver,  approximately  how  much  time,  based  on  your 
review  of  these  logs,  how  much  time  elapses  between  each  use  of  WGet? 

A.  Not  a  lot,  sir.  If  you  can  see  from  lines  7  through  13, 
they're  all  7:46.  Or  excuse  me  3:46.  So  not  a  lot  of  time  between 
each  one. 

Q.  And  let's,  if  you  could  just  look  at  those  lines 
specifically  and  just  move  to  the  right  there,  can  you  describe  the 
action  at  the  very  right  of  the  screen?  What  does  the  200  mean  and 
then  describe  going  right,  what  does  that  mean? 

A.  Yes,  sir.  Starting  at  200.  200  means  success.  The  number 
following  it  is  the  size  of  the  file.  And  a  little  further  to  the 
right  it  shows  what  was  used.  In  this  case  it  was  WGet  and  that  was 
the  version,  1.11.4. 

Q.  Now,  if  you  go  to  the  left  a  little  bit,  I  see  a  number  of 
lines  sort  of  recreated,  document  ID  equals  144708,  and  then  a  number 
of  document  IDs.  What  is  the  document  ID? 

A.  The  document  ID  —  The  server  this  is  being  captured  from 
is  a  Sharepoint  server  pertaining  to  Guantanamo  Bay  detainees.  As 
such  the  documents  are  not  stored  by  a  common  name,  they're  stored  by 
a  document  ID.  So  to  retrieve  it,  if  you  were  to  go  to  the  website, 
you  would  click  on  the  link  that  said,  a  file  common  name,  maybe  a 
person's  last  name.  But  actually  underneath  it  in  the  code  it  would 
say  to  retrieve  a  certain  document  ID. 
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Q.  So  in  this  case  what  does  the  document  ID  represent? 

A.  A  file  name. 

Q.  Agent  Shaver,  approximately  how  many  WGet  actions  did  you 
observe  in  this  log  on  7  March? 

A.  Over  700. 

ATC [CPT  MORROW]:  Your  Honor,  at  this  time  the  prosecution 

moves  to  admit  Prosecution  Exhibit  83  for  Identification  into 
evidence  as  Prosecution  Exhibit  83. 

ADC [CPT  TOOMAN] :  No  objection,  Your  Honor. 

MJ:  May  I  see  it,  please?  Thank  you.  Prosecution  Exhibit  83 

for  Identification  is  admitted. 

Q.  Agent  Shaver,  you  said  that  those  document  IDs  resolved  or 
went  back  to  the  detainee  assessments  located  on  the  SIPRNET .  Is 
that  correct? 

A.  Correct. 

Q.  Now,  in  any  time  in  your  review  of  the  Intelink  logs,  did 
you  notice  any  other  activity  or  accessing  of  information  on  detainee 
records  on  Intelink? 

A.  Yes,  sir. 

Q.  And  what  time  was  that? 

A.  5  March  2010. 

ATC [CPT  MORROW]:  I'm  retrieving  what's  been  marked  as 

Prosecution  Exhibit  82  for  Identification.  I'm  showing  it  to  the 
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defense  counsel.  I'm  handing  the  witness  what's  been  marked  as 
Prosecution  Exhibit  82  for  Identification. 

Q.  Do  you  recognize  that  document.  Agent  Shaver? 

A.  Yes,  sir,  I  do. 

Q.  And  what  is  that? 

A.  Sir,  this  is  a  document,  a  subset  of  the  Intelink  for  March 
5th,  yeah,  March  5th  2010. 

ATC [CPT  MORROW]:  Permission  to  publish  to  the  Court,  Your 

Honor . 

MJ:  Proceed. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
Prosecution  Exhibit  82  for  Identification  to  the  Court.] 

Q.  Agent  Shaver,  I'm  just  going  to  show  you  the  first  page  of 
the  exhibit.  And  if  you  would.  Agent  Shaver,  using  this  document, 
just  describe  the  activity  that  you're  seeing  in  the  logs. 

A.  The  activity,  is  somebody  is  on  a  computer  assigned  the  IP 
.22  is  downloading  files.  Again,  you  see  the  document  ID  again  and 
you  see  their  link  to  the  website  is  there  and  you  see  some  200s  and 
you  see  some  000s.  There's  an  issue  for  that  download  didn't  quite 
work  right.  And  there's  the  time  and  dates  associated  with  those 
downloads . 

Q.  Now,  in  terms  of  what  the  user  is  doing  or  what  you're 
observing  in  this  activity  on  the  Intelink  versus  the  7  March 
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activity,  what's  the  difference  between  those  two  accessing  —  the 
accessing  of  the  detainee  assessment  on  those  two  dates? 

A.  This  appears  to  be  a  lot  of  right  clicking,  save  as. 

Q.  And  why  do  you  say  that? 

A.  Because  it's  the  time.  It's  not  as  fast  and  there's  some 
errors,  so  it  looks,  it  appears  to  be  somebody's  manually  downloading 
these  files. 

Q.  Now,  did  you  observe  WGet  on  5  March? 

A.  I  do  not  —  No,  sir. 

Q.  And  how  do  you  know  that,  again,  these  are  detainee 
assessments,  where  in  the  logs  does  it  show  that  those  are  the  files 
being  accessed? 

A.  It  actually  says  it,  right  there;  action  line,  this  is  the 
website,  wiki/ JTF-GTMO_Detainee_Asessments . 

Q.  Thank  you.  Now,  again  - 

MJ:  Before  you  move  that  - 

ATC [CPT  MORROW]:  I'm  sorry. 

MJ:  I  did  have  a  question.  You  have  the  200s  where  you  say 

were  a  success,  after  some  of  the  200s  then  you  have  the  000,  what 
does  that  mean? 

WIT:  There's  a  problem. 

MJ:  Thank  you. 
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Q.  Agent  Shaver,  how  was  this,  again,  and  you  may  have  answered 
this,  how  was  this  summary  created? 

A.  I  filtered  based  off  the  date  and  the  action. 

ATC [CPT  MORROW]:  Your  Honor,  at  this  time  the  prosecution 

moves  to  admit  Prosecution  Exhibit  82  for  Identification  into 
evidence. 

ADC [CPT  TOOMAN] :  No  objection.  Your  Honor. 

MJ:  Prosecution  Exhibit  82  is  admitted. 

ATC [CPT  MORROW]:  Thank  you.  Agent  Shaver.  Government  has  no 

further  guestions  at  this  time. 

ADC [CPT  TOOMAN]:  Your  Honor,  the  defense  would  request  a  10- 

minute  comfort  break. 

MJ:  Any  objection? 

TC [MAJ  FEIN]:  No,  ma'am. 

MJ:  All  right.  Agent  Shaver,  please  don't  discuss  your 

testimony  or  knowledge  of  the  case  with  anyone  while  we  are  on  the 
recess.  Court  is  in  recess  until  5  minutes  to  11. 

[The  court-martial  recessed  at  1052,  10  June  2013.] 

[The  court-martial  was  called  to  order  at  1104,  2013.] 

MJ:  Court  is  called  to  order.  Let  the  record  reflect  all 

parties  present  when  the  Court  last  recessed  are  again  present  in 
court . 

Captain  Tooman,  cross-examination? 
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ADC [CPT  TOOMAN]:  Thank  you.  Your  Honor. 

CROSS-EXAMINATION 

Questions  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Good  morning.  Agent  Shaver. 

A.  Good  morning,  sir. 

Q.  Agent  Shaver,  I'd  like  to  start  out  by  on  direct  you  talked 
a  little  bit  about  some  of  the  computers  that  you  had  associated  with 
my  client. 

A.  Yes,  sir. 

Q.  You  had  associated  the  .22  machine? 

A.  Yes,  sir. 

Q.  That  was  one.  And  the  other  was  the  .40  machine? 

A.  Yes,  sir. 

Q.  Okay.  I  want  to  focus  on  the  .22  machine  for  just  a 
moment.  Now,  on  that  machine,  you  didn't  have  any  activity  that  you 
would  associate  with  my  client  before  2  March  in  the  allocated  space. 
Is  that  correct? 

A.  Okay. 

MJ:  Whoa,  whoa,  whoa. 

Q.  Okay.  On  the  .22  machine  there  was  a  user  account, 

Bradley .Manning,  correct? 

A.  Correct. 
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Q.  And  that  user  account  didn't  have  anything  in  the 
unallocated  space  before  2  March.  Is  that  correct? 

ATC [CPT  MORROW]:  Objection. 

MJ:  Yes. 

ATC [CPT  MORROW]:  Outside  the  scope  of  direct. 

MJ:  Overruled. 

WIT:  Sir,  your  terminology  I  believe  is  incorrect. 

Q.  Okay. 

A.  You're  asking  —  may  I  ask?  You're  asking  me  are  there  any 
files  pertaining  to  the  Bradley .Manning  user  account  prior  to  2 
March? 

Q.  2  March. 

A.  That  are  allocated. 

Q.  That  are  unallocated. 

A.  There  are  - 

Q.  Let  me  rephrase  the  question.  In  the  .22  computer,  there's 
a  user  account,  Bradley . Manning? 

A.  Correct. 

Q.  That  user  account  didn't  exist  before  2  March,  correct? 

A.  Correct. 

Q.  And  that  user  account  didn't  exist  before  2  March  because 

that  computer  had  been  re-imaged? 

A.  Correct. 
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Q.  And  that  computer  was  re-imaged  by  the  G6  or  whoever  was  in 
charge  of  those  computers? 

A.  That  is  correct. 

Q.  Okay.  And  you've  been  to  Irag? 

A.  Yes,  sir. 

Q.  Okay.  And  you  understand  that  there  are  a  lot  of  reasons 
why  a  computer  would  be  re-imaged  in  Irag? 

A.  Correct. 

Q.  It's  a  difficult  environment  for  the  machine? 

A.  Yes,  sir. 

Q.  It's  hot,  that  puts  stress  on  the  machine?  It's  dusty. 


sandy? 

A.  Yes,  sir. 

Q.  And  those  things  could  cause  problems  for  the  machine? 

A.  Correct. 

Q.  And  one  way  that  an  administrator  might  deal  with  those 
problems  is  to  re-image  it? 

A.  Correct. 

Q.  Okay.  That's  what  happened  with  the  .22  machine,  correct? 
A.  It  appears  to  be. 

Q.  Okay.  And  that  wasn't  anything  my  client  did,  that  was 
whoever  was  in  charge  of  those  machines? 


A.  Yes,  sir. 
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Q.  Okay.  Now,  you  talked  about  —  on  direct  you  talked  about 
the  Intelink  logs  and  the  searches,  and  you  talked  about  how  you 
created  the  Excel  document  where  you  were  able  to  pull  out  all  of  the 
actual  searches? 

A.  Yes,  sir. 

Q.  And  to  separate  the  wheat  from  the  chaff,  here  are  the 
searches,  correct? 

A.  Uh-huh. 

Q.  And  you  talked  about  a  number  of  searches  for  WikiLeaks? 

A.  Yes,  sir. 

Q.  You  talked  about  searches  for  ACIC  documents? 

A.  Just  WikiLeaks. 

Q.  Okay.  Well,  you  talked  about  searches  or  activity  on  the 
Intelink  logs  related  to  detainee  assessments? 

A.  Correct. 

Q.  There  were  in  total  from  May  —  I'm  sorry.  From  November  of 
2006  to  May  of  '10  there  were  probably  close  to  800  searches? 

A.  Sounds  right. 

Q.  And  not  all  of  those  had  to  do  with  WikiLeaks? 

A.  Correct. 

Q.  A  lot  of  those  searches  had  to  do  with  a  lot  of  other 
things? 

A.  Yes,  sir. 
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Q.  And  with  those  Intelink  logs,  all  you  can  really  say  is 
that  the  .22  machine  or  the  .40  machine  did  a  search  for  whatever 
term? 


A.  Correct. 

Q.  You  can't  say  that  that  was  PFC  Manning  who  did  the  search? 
A.  Correct. 

q.  You  can't  say  it  was  Captain  Tooman  who  did  the  search? 

A.  Correct. 

Q.  You  could  say  if  it  was  you  that  did  the  search,  but  you 
don't  know  who  did  the  search? 

A.  Correct. 

Q.  Okay.  There  were  a  lot  of  other  searches  done? 

A.  Yes,  sir. 

Q.  There  were  searches  for  gender  identity  disorder? 

A.  Yes,  sir. 

Q.  There  were  searches  for  APFT  scores? 

A.  Yes,  sir. 

Q.  There  were  searches  for  Green  to  Gold? 

A.  Yes,  sir. 

Q.  Now,  I  want  to  focus  on  some  more  of  those  searches.  There 
were  also  a  number  of  searches  related  to  CENTCOM,  correct? 

A.  Correct. 

Q.  Now,  CENTCOM  is  the  command  that  oversees  Iraq,  correct? 
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A.  Yes,  sir. 

Q.  Iraq  falls  underneath  CENTCOM.  So  there  would  be  a  lot  of 
reasons  why  a  computer  user  might  search  for  CENTCOM? 

A.  Sure. 

Q.  I  want  to  talk  about  some  of  those  CENTCOM  searches  a 
little  more  specifically.  There  was  a  search  for  CENTCOM  on  or 
involving  CENTCOM  on  30  November  2009.  Is  that  correct? 

A.  Sounds  right. 

Q.  There  was  another  search  on  9  December  for  CENTCOM  that  was 
done  by  the  40  machine? 

A.  Okay. 

Q.  Is  that  —  do  you  have  your  - 

A.  I  don't  have  the  notes  in  front  of  me,  sir. 

Q.  Okay. 

A.  That's  - 

MJ:  Let  me  ask  you  to  do  something,  please.  If  you  know 

something  to  be  a  fact  and  you're  agreeing  with  the  questioner,  say 
that.  If  you  don't  know  or  you're  not  sure  because  you  don't  have 
something  in  front  of  you,  don't  agree. 

WIT:  Okay. 

Q.  Is  there  anything  that  would  allow  you  to  answer  those 
questions? 

A.  Yes,  sir.  One  of  the  exhibits  from  earlier. 
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ADC [CPT  TOOMAN] :  Okay.  Your  Honor,  I'd  like  to  retrieve 

Prosecution  Exhibit  81  and  ask  Mr.  Shaver  —  Agent  Shaver  to  move  to 
the  witness  stand  because  I  believe  that's  classified. 

MJ:  All  right.  Certainly. 

ADC [CPT  TOOMAN]:  Handing  the  witness  what's  been  marked  as 

Prosecution  Exhibit  81. 

Q.  Agent  Shaver,  we'll  start  over.  We'll  start  from  the  top 
with  searches  that  implicate  CENTCOM.  On  the  30th  of  November  we 
have  a  search  by  the  .40  machine  related  to  CENTCOM.  Is  that 
correct? 

A.  Do  you  have  a  time? 

Q.  No,  I  do  not. 

A.  I'm  sorry  for  the  delay.  Your  Honor. 

MJ:  Take  your  time. 

WIT:  Yes,  sir. 

Q.  There's  also  a  search  on  9  December  by  the  .40  machine  and 
that's  a  search  for  SJA  plus  CENTCOM? 

A.  Yes,  sir. 

Q.  Now  on  the  15th  of  November  —  I'm  sorry  —  the  15th  of 
December,  again,  the  .40  machine,  we  have  a  search  just  for  CENTCOM? 

MJ:  Did  you  say  the  14th  of  December? 

ADC [CPT  TOOMAN]:  15th,  Your  Honor. 

WIT:  Correct.  Yes,  sir. 
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Q.  The  very  next  day,  again,  the  .40  machine  searched  for 
CENTCOM  plus  SJA? 

A.  Yes,  sir. 

Q.  Then  on  the  31st  of  December  the  .40  machine  searched  for 
CENTCOM  plus  portal? 

A.  Correct. 

Q.  2  January  2010,  we  see  the  40  machine  searching  for  CENTCOM 
plus  non-rel,  N-O-N-R-E-L? 

A.  Yes,  sir. 

Q.  On  the  4th  the  .40  machine  searches  for  CENTCOM? 

A.  Yes,  sir. 

Q.  Okay.  Then  our  next  search  is  the  19th  of  February,  still 
the  .40  machine  and  it's  just  for  CENTCOM? 

A.  What  date  again  was  that,  sir? 

Q.  19  February. 

A.  Yes,  sir. 

Q.  And  then  on  the  28th? 

A.  Yes,  sir. 

Q.  We  have  one  by  the  .40  machine  - 

A.  Yes,  sir. 

Q.  -  as  well?  And  that's  a  search  for  CENTCOM? 

A.  On  28  February,  yes,  sir. 
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Q.  Then  on  12  March,  we  see  our  first  search  from  the  .22 
machine,  and  that's  for  a  long  string,  but  you  would  agree  with  me 
that  that  is  basically  searching  for  Don't  Ask,  Don't  Tell? 

A.  Yes,  sir. 

Q.  Then  on  the  17th  of  March,  the  22  machine  searches  for, 
again,  another  long  string  E-Books  plus  site,  %3? 

A.  Yes,  sir,  I  see  that  one,  sir. 

Q.  Okay.  And  then  on  the  22nd  of  March  we  see  a  search  for 
Farah+CENTCOM,  and  that  was  the  22  machine? 

A.  Yes,  sir. 

ADC [CPT  TOOMAN] :  Agent  Shaver  I'm  going  to  retrieve  that 

exhibit  from  you.  Handing  Prosecution  Exhibit  81  back  to  the  court 
reporter. 

Q.  Now,  Agent  Shaver,  those  were  the  only  searches  for  CENTCOM 
on  the  Intelink  logs  that  specifically  talked  about  CENTCOM,  correct? 

A.  It  looks  that  way,  yes,  sir. 

Q.  And  there  was  only  one  that  specifically  searched  for 
Farah? 

A.  Correct. 

Q.  And  that  was  on  22  March? 

A.  Yes. 

Q.  Agent  Shaver,  I  want  to  talk  a  little  bit  more  about  Farah. 
You  talked  on  direct  about  there  are  ways  that  we  can  tell,  you  can 
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tell  a  search  was  done,  but  we  can't  really  tell  what  happened  after 
that.  Is  that  correct? 

A.  That  is  correct. 

Q.  There's  some  indication  that  maybe  a  file  was  viewed,  but 
we  have  to  look  other  places  to  find  out  what  happened  as  a  result  of 
that  search,  correct? 

A.  Correct. 

Q.  And  one  of  those  places  would  be  Centaur  logs.  Is  that 
correct? 

A.  Yes. 

Q.  Could  you  explain  for  the  Court  what  a  Centaur  log  is? 

A.  Yes,  sir. 

ATC [CPT  MORROW]:  Your  Honor,  objection. 

MJ:  Yes. 

ATC [CPT  MORROW]:  There's  been  no  evidence  to  suggest  that  he 

examined  something  called  a  Centaur  log.  Lack  of  foundation  here. 
It's  outside  the  scope  of  direct  examination. 

MJ:  How  is  it  within  the  scope  of  direct  examination? 

ADC [CPT  TOOMAN] :  It's  within  the  scope  of  direct  examination. 

Your  Honor,  because  the  government  talked  about  searches  and  then 
different  ways  that  we  can  see  what  happened  with  the  searches. 
Additionally,  the  government  has  already  requested  judicial  notice  of 
the  Centaur  logs  so  that's  already  something  the  Court  has 
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considered.  This  witness  has  reviewed  the  Centaur  logs,  he  will  talk 
about  that . 

MJ:  I'm  going  to  overrule  at  this  point.  He's  just  telling  me 

what  a  Centaur  log  is.  Do  you  dispute  the  fact  that  he  does  know 
what  it  is? 

ATC [CPT  MORROW]:  No,  Your  Honor.  I  do  dispute  the  fact  that 

we  asked  you  to  take  judicial  notice  of  the  Centaur  logs  though. 

MJ:  Do  you  have  your  consolidated  judicial  notice  list  has  that 

been  put  on  as  an  appellate  exhibit  yet? 

ADC [CPT  TOOMAN] :  Your  Honor,  it's  in  the  18  July  2012  ruling, 

Appellate  Exhibit  216. 

MJ:  May  I  see  Appellate  Exhibit  216,  please?  216  is  the  one 

you're  relying  on,  right? 

ADC [CPT  TOOMAN]:  Yes,  ma'am. 

MJ:  All  right.  Thank  you.  Government,  I'm  looking  at 

Appellate  Exhibit  216.  Number  4  talks  about  Centaur  logs. 

TC [MAJ  FEIN]:  Yes,  ma'am.  So  this  was  a  government  motion  to 
preadmit  evidence,  not  judicial  notice.  The  government  did  move  to 
preadmit  and  the  Court  ruled  that  based  off  the  government's  showing 
of  relevance  that  this  evidence  would  otherwise  be  admissible.  The 
government  does  intend  to  admit  this  evidence,  in  fact,  with  the 
predicate  witnesses  prior  to  Special  Agent  Shaver  and  then  Special 
Agent  Shaver's  testimony.  I  think  my  co-counsel's  objection  was  just 
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based  off  it's  outside  the  scope  of  this  direct  because  there's  no 
context,  no  foundation,  prior  facts  not  going  to  understand  that  the 
background  is  Centaur. 

MJ:  So  you're  going  to  be  recalling  this  witness  to  talk  about 

Centaur  logs  at  some  point? 

TC [MAJ  FEIN]:  Absolutely,  Your  Honor. 

MJ:  Why  are  we  getting  into  it  now? 

ADC [CPT  TOOMAN] :  Your  Honor,  the  defense  believes  that  the 

government  opened  the  door  to  Agent  Shaver's  investigation  and  we'd 
like  to  talk  to  him  about  it. 

M J :  The  government  didn't  mention  anything  about  Centaur  logs, 
so  are  you  waiving  your  relevance  objection  for  these  logs  to  come 
in? 

ADC [CPT  TOOMAN]:  Yes,  Your  Honor. 

TC [MAJ  FEIN]:  You  would? 

ADC [CPT  TOOMAN]:  Yes,  Your  Honor. 

MJ:  I  think  it's  beyond  the  scope  of  direct.  The  government 
just  didn't  talk  about  it,  so  I'm  going  to  sustain  the  objection. 

ADC [CPT  TOOMAN]:  Okay. 

Questions  continued  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Okay,  Agent  Shaver,  I'd  like  to  talk  to  you,  you  spoke  on 
direct  about  the  ACIC  report? 

A.  Yes,  sir. 
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Q.  And  you  saw  a  number  of  searches  for  that.  One  was  on  29 
December,  there  was  one  on  14  February? 


A. 

Correct . 

Q. 

And  then  there  were  two  on  1  March,  correct? 

A. 

Yes. 

Q. 

Your  testimony  on  direct  was  only  one  of  those  searches  was 

successful  and  that  only  one  time  did  something  get  pulled  up? 


A. 

No,  sir,  your  - 

Q. 

Okay. 

A. 

I  could  show,  number  one,  the  first  hit  was  a  success.  The 

other  ones  are  redirected.  I  don't  know  if  they're  successful. 
They're  redirected  to  another  log  file,  another  server.  I  cannot 
tell  you  if  it  was  either  successful  or  it  was  not. 

Q.  Okay.  So  only  that  first  search  could  you  say  for  sure 
this  was  successful? 


A. 

Correct . 

Q. 

Now,  based  on  your  review  of  the  intel  logs,  you  couldn't 

say  if 

that  document  was  downloaded,  correct? 

A. 

It  was  viewed,  so  technically  it  was  downloaded  because  you 

see  the  bytes  transferred.  It  was  viewed  upon  the  computer  itself 


Q. 

Okay.  You  couldn't  tell  if  there  was  a  right  click,  save 

as? 

A.  No,  sir 
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Q.  You  couldn't  tell  if  it  was  printed? 

A.  No,  sir. 

Q.  Okay.  You  also  couldn't  tell  how  long  that  screen  was  up, 
correct? 


A.  Correct. 

Q.  So  it  could  have  been  up  for  a  second,  it  could  have  been 
up  for  5  minutes? 

A.  Correct. 

Q.  The  same  would  be  true  for  the  C3  report  that  you  talked 
about  on  direct  as  well,  correct? 

A.  Correct. 

Q.  You  can't  tell  how  long  it  was  viewed.  Is  that  correct? 

A.  Correct. 

Q.  You  can't  tell  if  it  was  saved? 

A.  Correct. 

Q.  You  also  couldn't  tell  if  it  was  printed? 

A.  That's  correct. 

Q.  And  I  believe  you  said  that  the  22  machine  is  the  one  that 
did  those  things.  Either  way  you  can't  associate  the  viewing  of 
those  documents  with  any  particular  person,  correct? 

A.  Correct. 

Q.  Just  with  the  machine. 

A.  Correct. 
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Q.  I'd  like  to  speak  with  you,  you  talked  about  WGet  on 
direct.  I'd  like  to  talk  to  you  now  about  that.  You  would  agree 
with  me  that  WGet  is  a  program  that's  used  to  download  web  pages? 

A.  Yes,  sir. 

Q.  Kind  of  archive  pages? 

A.  Sure. 

Q.  Download  things? 

A.  Sure. 

Q.  You  wouldn't  say  that  this  is  a  program  that's  synonymous 
with  hacking,  would  you? 

A.  Correct.  It's  just  a  tool. 

Q.  Just  a  normal  program  that's  used  every  day  by  a  lot  of 
different  people? 

A.  Yes,  sir. 

Q.  Now,  you  talked  about  detainee  assessment  briefs? 

A.  Yes,  sir. 

Q.  And  you  talked  about  the  Intelink's  logs  show  that  on  5 
March  there  were  attempts  from  your  perspective  of  clicking,  opening 
and  saving,  that's  what  the  Intelink  log  suggested? 

A.  Correct. 

Q.  And  then  on  7  March  you  had,  again,  activity  with  the 
detainee  assessment  briefs,  but  here  it  looked  like  WGet  was  used  to 
download  those  files,  correct? 
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A.  Yes,  sir. 

Q.  You  would  agree  with  me  that  basically  what  WGet  was  doing 
was  clicking,  opening  and  saving,  it  was  just  doing  it  quickly? 

A.  In  automated  fashion. 

Q.  Faster  than  a  human  could  do  it? 

A.  Yes. 

Q.  But  still  the  same  action,  essentially  the  click,  open, 

save? 

A.  Correct. 

Q.  Now,  as  part  of  your  investigation,  you  actually  used  WGet, 
didn't  you? 

A.  Yes,  sir,  I  did. 

Q.  And  what  you  did  with  WGet  was  you  tried  to  download  —  you 
wanted  to  see  if  you  could  download  the  detainee  assessment  briefs? 

A.  Correct. 

Q.  And  you  were  able  to  do  that? 

A.  Yes,  sir. 

Q.  And  what  you  did  was  you  wrote  a  script  and  you  ran  the 
script  and  then  you  actually  downloaded  the  detainee  assessment 
briefs? 

A.  Yes,  sir. 

Q.  And  that  only  took  you  a  few  minutes  to  do? 

A.  Yes,  sir.  It  did  not  take  very  long. 
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Q.  It  didn't  take  very  long  to  download  over  700  detainee 
assessment  briefs? 

A.  Correct. 

Q.  And  while  that  was  happening,  you  were  able  to  do  other 
things  on  your  machine? 

A.  Yes,  sir. 

Q.  So  one  could  run  WGet  and  it  would  run  in  the  background 
and  you  could  do  other  things? 

A.  Yes,  sir.  You  would  take  a  performance  hit,  but,  yes. 

Q.  Sure.  When  WGet ' s  running,  you  don't  have  to  actually  be 
there,  do  you?  You  don't  have  to  be  sitting  at  the  computer  actively 
doing  anything,  correct? 

A.  No,  sir. 

Q.  And,  again,  it  basically  just  automates  the  click,  save  — 
or  click,  open,  save? 

A.  Correct. 


ADC [CPT  TOOMAN] : 
MJ:  All  right. 

ATC [CPT  MORROW]: 
MJ:  All  right. 


No  further  questions.  Your  Honor. 
Redirect. 

No,  Your  Honor. 

I  have  a  couple. 


[END  OF  PAGE] 
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EXAMINATION  BY  THE  COURT-MARTIAL 
Questions  by  the  military  judge: 

Q.  We  talked  earlier  about  the  200  means  it's  successful? 

A.  Uh,  huh. 

Q.  And  the  000  means  there's  a  problem? 

A.  There's  an  issue. 

Q.  And  we  talked  —  You  just  said  in  response  to  Captain 
Tooman’s  questions  that  when  a  search  is  redirected  to  somewhere 
else,  you  don't  know  what  happens  to  it.  Can  you  just  tell  me,  like 
give  me  an  example  of  a  search,  you  would  search  for  something  and  it 
would  go  somewhere  else  and  what  happens? 

A.  Yes,  ma'am.  So  are  you  familiar  with  Google? 

Q.  Yes. 

A.  So  you  open  Google  and  you  put  in  Wolf  Blitzer,  it  takes 
you  to  the  CNN  web  page  and  now  you're  on  the  CNN  web  page.  Google 
is  no  longer  tracking  what  you're  doing  on  CNN,  but  the  redirect  took 
you  there.  And  in  this  instance  that  RB  —  the  RB  document  was 
directed  to  another  site,  and  once  it's  on  the  other  site  it's  no 
longer  part  of  Intelink.  Does  that  make  sense? 

Q.  Yes.  Thank  you.  You  testified  earlier  that  to  assess 
whether  a  program  is  authorized  on  an  Army  computer,  I  just  want  to 
make  sure  I  got  your  testimony  correctly.  What  did  you  use  the  Army 
Gold  Master's  program  to  determine? 
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A.  We  used  that  --  excuse  me.  When  I  worked  at  CCIU,  we  would 
use  that  to  determine  what  are  the  authorized  programs,  those  are  the 
Army  programs  that  are  commonly  available  to  the  computers,  to  the 
computers  on  the  Army  network.  WGet  was  never  part  of  those. 

Q.  If  you're  not  the  right  witness  to  ask  this  question  to, 
tell  me.  Are  you  familiar  with,  does  that  program  say  that  if  it's 
not  on  here,  you  can't  use  it  or  you  can't  put  it  on  the  computer? 

A.  No,  ma'am.  That  would  be  considered  a  certificate  of 
networthiness ,  also  called  a  CON.  That's  where  --  That  would  be  the 
final  authority  on  what's  authorized  and  what  is  unauthorized. 

Q.  I'm  beginning  to  stray  into  areas  that  the  government 
mentioned  on  their  direct,  but  were  not  fully  explored.  Any 
objection  to  my  continuing  to  question  this  witness  about  them? 

ATC [CPT  MORROW]:  No,  Your  Honor. 

ADC [CPT  TOOMAN] :  No,  ma'am. 

Q.  All  right.  So,  tell  me  what  that  was  called  again,  a 
certificate  of  - 

A.  Networthiness.  It's  commonly  referred  to  as  a  CON,  C-O-N. 

Q.  Assume  I'm  a  computer  user  and  I  want  to  —  how  do  I  go 
about  obtaining  a  CON? 

A.  It  is  a  process  through  one  of  the  Army  CERTS,  the  Army 
Regional  Computer  Emergency  Response  Team  at  Fort  Huachuca,  Arizona. 
You  would  put  in  a  request  to  use  a  piece  of  software  on  the  Army 
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network.  They  would  evaluate  it  to  make  sure  it's  not  it  meets 
certain  criteria,  whether  you  have  to  pay  for  it,  what  it  does  on  the 
network,  does  it  create  a  vulnerability  on  the  network.  And  then 
they  would  eventually  get  back  to  you  and  say  yes  or  no. 

Q.  The  Army  sometimes  structures  automation  such  that  the  user 
does  not  have  administrative  rights  to  insert  —  to  add  things  in  the 
computers  that  you  examined  that  you  testified  about  today,  could  the 
user  —  did  the  user  have  administrative  rights  to  add  whatever  they 
wanted  to? 

A.  No,  ma'am,  they  do  not.  However,  WGet  is  the  the 
executable  itself  does  not  need  administrative  privileges  to  run,  so 
you  can  use,  anybody  can  download  it,  anybody  can  run  it. 

Q.  Are  you  aware  of  any  specific  authorization  of  or 
prohibition  of  program  WGet? 

A.  When  I  looked  at  the  certificate  of  networthiness ,  WGet  was 
not  on  that  list. 

Q.  So  that  certificate  is  one  certificate  of 

A.  It's  the  —  The  CON  itself  is  one  —  the  one  I  saw  was  an 
Excel  spreadsheet  of  what  was  authorized  and  what  was  not  authorized 
for  the  Army  network.  I  was  looking  at  it  for  another  matter.  I 
obtained  it  for  another  case.  But  WGet  was  not  present  on  that  CON. 

Q.  And  that  CON  was  applicable  for  what,  a  particular  unit  or 
geographic  area? 
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A.  As  far  as  I  know,  the  Army. 

MJ:  Any  follow-up  questions  from  either  side  based  on  my 

questions? 

ATC [CPT  MORROW]:  One  moment.  Your  Honor.  Just  a  couple  of 

questions.  Your  Honor. 

REDIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  Agent  Shaver,  when  someone  searches  for  something  on  the 
SIPRNET ,  and  we've  probably  have  gone  over  this  again,  but  what  does 
the  resulting,  at  least  if  you're  on  the  Intelink  server,  what  does 
the  resulting  activity  show  in  the  logs? 

A.  It  would  show  any  hits  pertinent  to  the  search  you  put  in. 

Q.  Now,  when  you  say  hits,  what  do  you  mean  by  that? 

A.  Again,  it's  basically  Google,  so  if  you  put  a  keyword  in, 
again,  let's  go  back  to  Wolf  Blitzer,  all  the  hits  --  everything  that 
pops  up  would  be  pertinent  to  the  key  term  Wolf  Blitzer. 

Q.  So  you  would  have  a  number  of  results? 

A.  Yes,  sir. 

Q.  And  if  you  clicked  on  one  of  those  results,  what  would 
happen? 

A.  Say  for  —  It  would  take  you  to  the  website  or  the  document 
pertaining  to  that  information. 
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Q.  Now,  if  it  took  you  to  the  website  or  document  pertaining 
to  that  information,  would  that  activity  always  be  captured  by  the 
Intelink  logs? 

A.  No,  sir. 

Q.  And  why  is  that? 

A.  Depends,  sir.  Depends  where  the  document  is  located. 

Again,  if  it's  not  on  —  if  it's  on  another  website  it  would  be 
captured  —  that  information  would  be  captured  on  that  other  website. 

Q.  Agent  Shaver,  when  you  were  talking  about  the  certificate 
of  networthiness,  what  type  of  computer  were  you  referring  to? 

A.  A  Windows  computer. 

Q.  But  SIPRNET,  NIPRNET,  what  were  you  talking  about? 

A.  Either  or. 

Q.  Now  have  you  seen  the  certificate  of  networthiness  for  a 
DCGS  Alpha  computer? 

A.  No,  sir,  I  have  not. 

Q.  And  where  does  WGet  come  from,  where  does  someone  acquire 
or  obtain  the  WGet  program? 

A.  You  would  find  it  on  the  —  you  would  search  for  it  on  the 
Internet  and  find  it  on  the  Internet. 

Q.  So  it's  available  to  anyone  on  the  Internet? 

A.  That's  correct. 
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Q.  And  if  you  were  to  put  a  program  or  an  executable  like  WGet 
on  a  computer,  and  you  wanted  it  to  be  available  to  all  the  users  of 
that  computer,  anyone  who  logged  in,  where  would  you  put  it  on  the 
computer? 

A.  Program  files. 

Q.  And  why  would  you  put  it  in  the  program  files  if  you  wanted 
it  to  be  available  to  all  the  users  of  that  computer? 

A.  It ' s  a  permission  issue.  So  everybody  would  have  access  to 
it.  They  can  all  execute  to  that  document.  If  for  example  you  put 
it  in  a  user  profile,  one  user  profile  just  due  to  permissions  cannot 
see  the  contents  of  another  user  for  security  reasons. 

Q.  So  a  computer  may  have  any  number  of  user  profiles  because, 
at  least  in  the  government,  people  share  computers,  right? 

A.  Yes,  sir. 

ATC [CPT  MORROW]:  Okay.  Thank  you. 

ADC [OPT  TOOMAN] :  Just  a  couple.  Your  Honor. 

RECROSS-EXAMINATION 

Questions  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Agent  Shaver. 

A.  Sir. 

Q.  You  spoke  about  the  Army  Gold  Master's  Program.  The  Army 
Gold  Master  Program,  they  don't  review  every  program  or  software 
executable  file  that  exists,  correct? 
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A.  The  Army  Gold  Master  is  just  a  disk  of  software  they 
provide,  the  Army  provides  to  the  users. 

Q.  Well,  the  Army  doesn't  review  every  single  file  or  piece  of 
software  type  of  executable  file  to  determine  whether  or  not  there  s 
a  certificate  of  networthiness  for  it,  correct?  Did  it  look  at 
everything? 

A.  Everything  in  the  world  or  everything 

Q.  Everything  in  the  world. 

A.  No. 

Q.  So  the  fact  that  there  isn't  a  certificate  of  networthiness 
doesn't  necessarily  mean  that  it  would  be  a  problem  to  have  it  on  the 
Army  system? 

A.  Technically  as  I  understand  it,  technically  you  would  need 
an  exception  to  policy.  It's  the  Army.  You  would  just  have  an 
exception  of  policy  to  run  a  specific  program  on  a  specific  network 
for  a  specific  reason.  There  would  be  a  signed  document  for  that. 

Q.  And  I  guess  a  certificate  of  networthiness  or  the  lack  of  a 
certificate  of  networthiness  doesn't  mean  if  the  program  were 
reviewed  it  wouldn't  get  one? 

A.  Correct. 

Q.  Now,  you  talked  about  WGet .  WGet  is  an  executable  file, 
correct? 

A.  That's  correct. 
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Q.  And  you  double  click  on  it,  it  opens,  and  it  runs,  correct? 

A.  You  would  have  to  —  Again,  it's  a  command  line,  so  if  you 
double  click  on  it,  a  black  window  would  open  and  close  very  quickly 
and  not  do  anything.  You  have  to  do  it  from  the  command  line. 

Q.  Okay.  Well,  you  would  agree  with  me  that  it's  an 
executable  file? 

A.  Yes,  sir. 

Q.  And  Army  systems  can  be  configured  to  prevent  the  running 
of  executable  files? 

A.  Yes. 

Q.  Now,  you  talked  about  where  an  individual  can  put  a  file  if 
they  add  something  to  their  machine.  They  could  put  it  in  their  own 
personal  user  file  or  it  could  get  added  to  program  files,  correct? 

A.  Correct. 

Q.  If  I  wanted  to  add  something  to  the  program  files,  I  would 
need  administrative  rights  for  that,  wouldn't  I? 

A.  That's  correct. 

ADC [CPT  TOOMAN] :  Nothing  further.  Your  Honor.  Thank  you. 

MJ:  Any  redirect  from  the  government? 

ATC [CPT  MORROW]:  No,  Your  Honor. 

[END  OF  PAGE] 
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EXAMINATION  BY  THE  COURT-MARTIAL 
Questions  by  the  military  judge: 

Q.  Let  me  just  make  sure  I'm  clear  on  this.  Based  on  the  last 
question  from  Captain  Tooman,  am  I  understanding  this  WGet  program 
was  in  the  user  files  as  opposed  to  the  programs  file  on  the 
computers  you  found? 

A.  Correct. 

Q.  If  the  user  attempted  to  put  WGet  on  the  programs  file, 
what  would  have  happened? 

A.  They  would  ask  for  permission.  They  would  ask  for 
administrator  privilege  or  account  to  do  this. 

Q.  Assume  —  Well,  did  the  user  in  this  case  have  an 
administrative  privilege  account? 

A.  No. 

Q.  If  the  user  tried  to  put  that  program  on  a  program  drive 
without  going  through  that  process  that  you  just  described,  would  the 
computer  let  him? 

A.  No. 

MJ:  All  right.  Any  further  questions  based  on  mine 

ATC [CPT  MORROW]:  No,  Your  Honor. 

ADC [CPT  TOOMAN]:  No,  ma'am. 

MJ:  All  right.  Temporarily  excusal? 

ATC [CPT  MORROW]:  Temporary,  Your  Honor. 
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[The  witness  was  temporarily  excused,  duly  warned,  and  withdrew  from 
the  courtroom . ] 

ATC [CPT  WHYTE]:  Ma'am,  the  United  States  calls  Mr.  Chad 

Madaras . 

CHAD  MADARAS,  was  called  as  a  witness  for  the  prosecution,  was  sworn, 
and  testified  as  follows : 

DIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  WHYTE] : 

Q.  You  are  Chad  Madaras  from  Caseville,  New  York? 

A.  Yes,  sir. 

Q.  Mr.  Madaras,  what  is  your  current  military  status? 

A.  I'm  inactive  ready  reserves,  sir. 

Q.  When  did  you  leave  the  military? 

A.  January  16th  2013. 

Q.  And  how  long  did  you  serve  for? 

A.  Approximately  6  years,  sir. 

Q.  What  was  your  MOS  during  that  time? 

A.  I  was  a  35  Fox  Intel  Analyst. 

Q.  For  the  entire  6  years? 

A.  Yes,  sir. 

Q.  And  where  were  you  stationed? 

A.  At  Fort  Drum. 

Q.  Do  you  remember  when  you  arrived  at  Fort  Drum? 
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November  of  2007. 

When  you  arrived  what  unit  were  you  assigned  to? 

Second  Brigade,  sir. 

Of  10th  Mountain  Division? 

Yes,  sir. 

And  how  did  you  know  PFC  Manning  at  Fort  Drum? 

I  didn't  really  know  him  that  well  at  Fort  Drum.  I  had 
just  met  him  once  in  the  smoking  area  outside  our  barracks. 

Q.  Did  you  deploy  out  of  Fort  Drum? 

Yes,  sir. 

And  what  pre-deployment  training  did  you  receive? 

I  had  two  JRTC  rotations  and  a  DCGS-A  course. 

The  JRTC,  when  were  those? 

October  of  2008  and  July  of  2009,  sir. 

Did  PFC  Manning  attend  both  of  those  with  you? 

From  the  best  of  my  recollection,  yes. 

And  you  mentioned  a  DCGS  training.  Can  you  explain  what 
that  consisted  of? 

A.  We  had  a  DCGS  course  that  just  covered  all  the  fundamentals 
of  a  DCGS  machine,  multi-function  work  station  and  how  to  use  all  the 
components  of  it. 

Q.  Did  PFC  Manning  attend  that  with  you? 

A.  Yes,  he  did. 


Q. 

A. 

Q. 

A. 

Q. 

A. 


A. 

Q. 

A. 

Q. 

A. 

Q. 

A. 

Q. 
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Q.  At  this  training  what  were  you  taught  about  who  was 
responsible  for  handling  the  DCGS  machine  in  theater? 

A.  We  were  told  we  have  a  DCGS  FSR  downrange  with  us  that 
would  take  care  of  anything  DCGS-A  related. 

Q.  And  what  is  an  FSR? 

A.  Field  Support  Representative,  sir. 

Q.  How  long  is  this  training  on  the  DCGS  machine? 

A.  It  was  a  week  long,  sir. 

Q.  So  where  did  you  deploy  from  Second  Brigade,  or  From  Fort 

Drum? 

A.  What  was  that,  sir? 

Q.  Where  did  you  deploy  to  from  Fort  Drum? 

A.  FOB  Hammer,  Iraq,  sir. 

Q.  Did  PFC  Manning  deploy  to  Hammer  as  well? 

A.  Yes,  sir. 

Q.  Do  you  remember  when  you  arrived  at  FOB  Hammer? 

A.  Sometime  around  October  15th  2009. 

Q.  Do  your  remember  when  PFC  Manning  arrived? 

A.  It  would  be  about  a  week  or  two  later,  sir. 

Q.  Where  did  you  work  at  FOB  Hammer? 

A.  In  the  Brigade  SCIF. 

Q.  Where  did  PFC  Manning  work? 

A.  In  the  Brigade  SCIF  also. 
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Q.  And  what  cell  within  the  --  or  what  section  were  you 
assigned  to? 

A.  We  were  Fusion  Cell,  part  of  the  Shia  team. 

Q.  What  do  you  mean  by  we? 

A.  Me  and  PFC  Manning. 

Q.  So  you  both  were  Shia  - 

A.  Yes,  sir. 

Q.  -  Intel  Analysts  working  in  the  SCIF? 

A.  Yes,  sir. 

Q.  What  shift  did  you  work  on? 

A.  I  worked  day  shift. 

Q.  And  what  shift  did  Manning  work  on? 

A.  The  night  shift. 

Q.  What  type  of  computer  did  you  use  at  FOB  Hammer? 

A.  We  used  DCGS-A  laptop,  Dell. 

Q.  And  how  many  computers  did  you  have  at  your  work  station  in 
the  SCIF? 

A.  Just  one,  sir. 

Q.  And  who  did  you  share  that  work  station  with? 

A.  I  shared  it  with  PFC  Manning. 

Q.  What  network  was  this  DCGS  machine  hooked  up  to? 

A.  It  was  on  the  SIPRNET  work,  sir. 

Q.  And  who  did  you  share  this  DCGS  SIPRNET  machine  with? 
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A.  With  PFC  Manning. 

Q.  For  how  long  did  you  share  this? 

A.  For  about  6  months. 

Q.  So,  when  in  the  deployment  did  you  share  this? 

A.  When  we  first  took  over  all  the  way  up  until  around  the 
March  timeframe,  sir. 

Q.  So  let's  just  talk  about  when  you  were  actually  in  the 
SCIF,  just  to  give  the  Court  a  time  line.  You  said  you  arrived  15 
October  2009? 

A.  Yes,  sir. 

Q.  When  was  the  first  time  that  you  left  the  SCIF? 

A.  Just  before  Christmas  of  2009. 

Q.  And  where  did  you  go? 

A.  I  went  to  BIAP. 

Q.  And  where  --  how  long  was  this? 

A.  It  was  about  a  week  long. 

Q.  And  then  you  returned  back  to  FOB  - 

A.  Yes,  sir. 

Q.  -  Hammer  working  in  the  SCIF? 

A.  Yes,  sir. 

Q.  When  did  you  next  leave  FOB  Hammer? 

A.  I  left  around  January  27th  or  28th,  when  I  went  on  R  and  R. 
Q.  And  how  long  were  you  gone  for? 
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A.  I  returned  around  February  15th. 

Q.  What  about  the  next  time  you  left  FOB  Hammer? 

A.  I  left  in  March  for  the  parliamentary  elections  of  Iraq. 

Q.  And  how  long  were  you  gone  for? 

A.  For  a  week  again,  sir. 

Q.  So  when  did  you  stop  working  in  the  SCIF? 

A.  Around  the  end  of  May,  beginning  of  June,  sir. 

Q.  Are  you  familiar  with  Intelink? 

A.  Yes,  sir. 

Q.  What  is  Intelink? 

A.  It ' s  a  separate  search  engine  like  Google  within  SIPR. 

Q.  Did  you  use  Intelink  as  a  35  Fox? 

A.  Yes,  sir. 

Q.  So,  what  are  some  of  the  benefits  of  using  Intelink  as  a  35 

Fox? 

A.  If  you  didn't  have  a  lot  of  information  on  somebody  or  a 
name  came  up  in  a  report  that  you  weren't  really  sure,  you  could  just 
throw  it  in  there  to  see  if  you  got  any  hits  right  off  the  bat. 

ATC[CPT  WHYTE]:  Let  the  record  reflect  that  I'm  retrieving 

Prosecution  Exhibit  81  from  the  court  reporter. 

CDC [MR .  COOMBS]:  Your  Honor,  to  the  extent  that  the 

government  is  going  to  use  81  to  ask  this  witness  did  he  do  any  of 
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those  searches,  we  would  stipulate  that  he  did  not  do  any  of  those 
searches . 

MJ:  All  right.  Is  that  where  you  were  going  with  this? 

ATC [CPT  WHYTE]:  Yes,  Your  Honor.  But  it  may  be  helpful  to 

the  Court  to  actually  hear  what  searches  Mr.  Madaras  did  not  search. 
TC [MAJ  FEIN]:  May  we  have  a  moment.  Your  Honor? 

MJ:  Why?  Okay. 

[There  was  a  pause  while  the  trial  counsel  consulted  with  the 
assistant  trial  counsel . ] 

MJ:  Why  would  it  be  beneficial?  If  the  defense  is  stipulating 

that  the  witness  did  not  do  any  of  those  searches,  why  would  it  be 
beneficial  for  me  to  listen  to  the  particular  searches  that  he  did 
not  do? 

ATC [CPT  WHYTE]:  Yes,  ma'am.  Never  mind,  we  will  not  ask 

that  witness. 

MJ:  Proceed. 

Questions  continued  by  the  assistant  trial  counsel  [CPT  WHYTE] : 

Q.  Mr.  Madaras,  did  you  use  CIDNE-Iraq  to  pull  intelligence? 
A.  Yes,  sir. 

Q.  Are  you  aware  if  there's  a  CIDNE-Af ghanistan? 

A.  There  is,  sir. 

Q.  Did  you  use  CIDNE-Af ghanistan? 

A.  No,  sir. 
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Q. 

Why  not? 

2 

A. 

It  did  not  really  pertaii 

3 

area . 

4 

Q. 

Did  you  use  Net-Centric  < 

5 

intelligence? 

6 

A. 

No,  sir. 

7 

Q. 

Did  you  pull  any  Departnu 

8 

A. 

No,  sir. 

9 

Q. 

What  region  of  the  world 

10 

at  FOB 

Hammer? 

11 

A. 

Eastern  Baghdad. 

12 

Q. 

Did  you  ever  search  for  : 

13 

A. 

No,  sir. 

14 

Q. 

How  about  South  America? 

15 

A. 

No,  sir. 

16 

Q. 

Europe? 

17 

A. 

No,  sir. 

18 

Q. 

Africa? 

19 

A. 

No,  sir. 

20 

Q. 

East  Asia? 

21 

A. 

No. 

22 

Q. 

And  why  not? 
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A.  It  did  not  pertain  to  anything  we  were  doing  in  eastern 
Baghdad. 

Q.  Are  you  familiar  with  WGet? 

A.  No,  sir. 

Q.  Let's  talk  about  some  of  the  issues  that  you  had  with  your 
computer  when  you  were  at  FOB  Hammer.  During  your  deployment  explain 
what  type  of  problems  you  had  with  your  computer  at  FOB  Hammer? 

A.  The  computer  used  to  crash  on  a  regular  basis  or  operate 
really,  really  slowly  to  the  point  where  it  was  difficult  to  get  any 
work  done. 

Q.  And  how  often  did  you  have  these  computer  problems? 

A.  About  twice  a  week. 

Q.  So  can  you  please  explain  to  the  Court  during  those  two 
times  per  week  you  showed  up  for  a  shift  change,  what  happened? 

A.  When  I'd  log  on  to  the  computer,  it  would  run  really  slow, 

wouldn't  really  load  up  anything  that  I  was  trying  to  use  to  complete 
my  work,  and  then  sometimes  it  would  just  completely  crash. 

Q.  And  when  did  you  notice  these  computer  problems? 

A.  It  was  right  off  the  bat  at  the  beginning  of  shift. 

Q.  So  what  would  you  do  when  you  had  these  computer  problems? 

A.  I'd  get  Alan  Milliman  and  have  him  to  work  on  the  machine. 

Q.  And  who  was  Mr.  Milliman? 

A.  He  was  our  DCGS  FSR. 
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Q.  What  would  Mr.  Milliman  do  to  fix  the  machines? 

A.  He'd  usually  have  to  re-image  the  system. 

Q.  After  Mr.  Milliman  worked  on  the  computer,  can  you  describe 
how  the  computer  operated? 

A.  It  would  operate  like  brand  new  again. 

Q.  How  did  it  operate  for  the  remainder  of  your  shift? 

A.  It  would  operate  well. 

Q.  What  about  the  following  day? 

A.  It  would  slowly  start  to  deteriorate. 

Q.  How  many  times  did  Mr.  Milliman  re-image  your  computer? 

A.  Probably  about  five  times,  sir. 

Q.  And  what  was  your  understanding  of  why  you  were  having 
these  computer  problems? 

CDC [MR .  COOMBS]:  Objection,  Your  Honor.  Calls  for  hearsay. 

MJ:  Is  --  Did  this  witness  get  his  understanding  from  somebody 

else? 


ATC [CPT  WHYTE]:  Yes,  Your  Honor. 

MJ:  What's  the  hearsay  exception? 

ATC [CPT  WHYTE]:  It's  actually  not  for  the  truth  of  the 

matter  asserted.  It's  effect  on  the  listener,  what  Mr.  Madaras  did 
in  response  to  that. 

MJ:  And  the  question  was  again? 
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ATC [CPT  WHYTE]:  The  question  was  what  was  your  understanding 

as  to  why  you  were  having  these  computer  problems. 

MJ:  Why  don't  you  just  ask  him  after  you  understood  why  you 

were  having  the  computer  problems  what  did  you  do  next? 

Questions  continued  by  the  assistant  trial  counsel  [CPT  WHYTE] : 

Q.  After  you  understood  —  After  you  knew  that  you  were  having 
these  computer  problems,  what  did  you  do  next? 

A.  I  asked  PFC  Manning  to  try  to  remove  some  of  the  unneeded 
documents  off  his  desktop,  and  I  also  did  so  myself. 

Q.  Did  you  look  at  PFC  Manning's  desktop? 

A.  I  couldn't  see  the  desktop,  but  I  could  see  the  file  size. 

Q.  And  how  would  you  describe  the  file  size? 

A.  It  was  very  large. 

Q.  What  did  you  store  on  your  desktop? 

A.  I  would  store  any  project  that  I  was  currently  working  on, 
so  Power  Points  and  any  reports  that  I  needed  to  work  on  the  project. 

Q.  So  what  did  you  do  to  reduce  your  desktop  size? 

A.  Anything  that  was  from  previous  project  I  was  working  on  I 
went  ahead  and  I  deleted  them,  got  rid  of  them. 

Q.  So  after  you  told  PFC  Manning  to  limit  the  amount  on  his 
desktop,  did  you  have  problems  after  that? 

A.  Yes,  I  still  did. 
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Q.  How  did  your  computer  problems  affect  your  ability  to  work 
at  FOB  Hammer? 

A.  It  would  take  about  2  hours  of  my  work  schedule  for  Alan  to 
figure  out  what  was  wrong  with  it,  and  if  he  had  to  re-image  it  it 
would  take  approximately  2  hours. 

Q.  And  how  often  did  other  35  Foxes  have  problems  with  their 
computers? 

A.  Everybody  had  one  about  once  throughout  their  entire 
deployment . 

Q.  Do  you  remember  when  you  stopped  sharing  a  computer  with 
PFC  Manning? 

A.  It  was  when  I  returned  from  the  elections  in  March  of  2010. 

ATC [CPT  WHYTE]:  No  further  questions.  Your  Honor. 

M J :  Defense?  Proceed. 

CROSS-EXAMINATION 

Questions  by  the  civilian  defense  counsel  [MR-  COOMBS] : 

Q.  Sergeant  Madaras,  well,  I'm  sorry  I  got  used  to  calling  you 
Sergeant  Madaras.  Mr.  Madaras,  you  first  met  PFC  Manning  in  2008? 

A.  Yes,  sir. 

Q.  And  this  was  out  in  a  smoking  area  outside  the  barracks  at 
Fort  Drum? 

A.  Correct,  sir. 
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Q.  And  based  upon  those  times  that  you  spoke  with  PFC  Manning, 
you  recall  him  being  interested  in  U.S.  politics? 

A.  Yes,  sir. 

Q.  And  the  way  he  talked,  you  got  the  impression  that  he  was 
interested  in  going  into  politics? 

A.  Not  that  I  can  remember,  sir. 

Q.  Do  you  recall  telling  me  that  based  upon  the  way  he  talked 
you  got  the  impression  that  he  was  interested  in  going  in? 

A.  No,  sir. 

Q.  And  during  those  times  that  you  spoke  with  him,  he  never 
said  anything  that  gave  you  the  impression  that  - 

TC [MAJ  FEIN]:  Objection,  Your  Honor.  Hearsay. 

MJ:  Yes. 

CDC [MR.  COOMBS]:  I'm  not  asking  for  a  response,  I'm  asking 

for  —  if  I  could  finish  my  question,  and  then  I  think  the  objection 
may  be  appropriate  to  - 

MJ:  What  is  the  question? 

CDC [MR.  COOMBS] :  -  make  it  at  that  point.  During  the 

times  you  spoke  with  him,  he  never  gave  you  the  impression  that  he 
held  any  anti-American  positions. 

MJ:  All  right.  I'll  allow  that.  Go  ahead. 
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Questions  continued  by  the  civilian  defense  counsel  [MR.  COOMBS] : 

A.  No,  sir. 

Q.  Now,  you  and  PFC  Manning  both  went  to  JRTC  in  2009? 

A.  Yes,  sir. 

Q.  And  JRTC  was  the  training  that  you  received  in  preparation 
for  deployment  to  Iraq? 

A.  Yes,  sir. 

Q.  And  at  JRTC  the  two  of  you  worked  opposite  shifts? 

A.  Correct,  sir. 

Q.  You  worked  the  night  shift? 

A.  Yes,  sir. 

Q.  And  PFC  Manning  worked  the  day  shift? 

A.  Yes,  sir. 

Q.  And  at  JRTC,  PFC  Manning  was  in  charge  of  working  on  the 
company's  computers  if  there  was  any  problems? 

A.  I  don't  know  if  he  was  in  charge  of  working  on  the 
computers,  sir,  but  he  may  have  worked  on  computers,  yes. 

Q.  All  right.  Well  let's  go  with  what  you  —  you  know  he 
worked  on  the  company's  computers  at  JRTC? 

A.  Yes,  sir. 

Q.  He  unlocked  some  of  the  computer  passwords  for  the  S-2 
section? 

A.  Not  that  I  remember  at  this  time,  sir.  I  don't  know. 
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Q.  Do  you  recall  telling  me  that  he  unlocked  - 

A.  I  don't  remember. 

Q.  Let  me  finish  my  question.  Do  you  recall  telling  me  that 
he  unlocked  some  of  the  computer  passwords  at  the  S-2  section? 

A.  I  do  not  remember  that,  sir. 

Q.  When  you  say  you  don't  remember,  are  you  saying  I  don't 
remember  now  because  my  memory  is  failing,  or  I  don't  remember  it 
because  I  don't  think  I  ever  said  that  to  you? 

A.  I  don't  remember  it  because  memory  is  failing  from  that 
long  ago,  sir. 

Q.  Okay.  Now,  the  times  in  which  he  was  working  on  the 
computers,  did  anyone  to  your  memory  go  in  and  say,  stop,  you're  not 
permitted  to  do  that? 

A.  No,  sir. 

Q.  And  he  was  very  good  at  working  on  the  computers,  correct? 

A.  Yes,  sir. 

Q.  And  what  type  of  computers  did  you  work  off  as  an  analyst 
at  JRTC? 


A.  DCGS-A  computers. 

Q.  Now,  in  Iraq  you  also  had  DCGS-A  computers,  correct? 
A.  Yes,  sir. 

Q.  And  you're  not  really  a  computer  guy,  is  that  right? 
A.  Correct. 
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Q.  You  don't  know  much  about  computers  beyond  basically  the 
basic  operating  system? 

A.  Correct,  sir. 

Q.  But  you  knew  that  PFC  Manning  would  occasionally  work  on 
the  DCGS-A  computers  in  Iraq? 

A.  Possibly,  sir. 

Q.  Possibly  meaning  what?  I'm  sorry. 

A.  It's  possible  that  he  did.  I  don't  remember. 

Q.  And  I'm  sorry  to  pin  you  down.  Are  you  saying  you  don't 

remember  because  so  much  time  has  gone  by,  or  are  you  saying  you 
don't  remember  because  you  don't  believe  he  ever  worked  on  the  DCGS-A 
computers? 

A.  So  much  time  has  gone  by. 

Q.  You  don't  recall  that? 

A.  I  don't  recall,  yes. 

Q.  Do  you  ever  recall  telling  me  that  on  the  phone? 


Q.  Now,  did  you  —  do  you  recall  telling  me  that  you  saw  him 
go  into  the  operating  system  and  try  to  make  the  computer  run  faster? 
A.  No,  sir. 

Q.  You  don't  recall  telling  me  that? 

A.  No,  sir. 
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Q.  We  talked  a  little  over  now  about  2  and  a  half  weeks  ago. 
You  don't  recall  telling  me  that  at  that  point? 

A.  I  didn't  talk  to  you  about  2  and  a  half  weeks  ago,  sir. 

Q.  When's  the  last  time  you  recall? 

A.  It  was  probably  about  2  years  ago  before  the  Article  32 
hearing  was  the  last  time  I  recall  talking  to  you. 

Q.  That's  the  last  time  you  recall  talking  to  me? 

A.  Yes,  sir. 

Q.  Okay.  Do  you  recall  telling  me  that  you  witnessed  him  go 
into  the  task  manager  and  change  what  programs  are  running  and  how 
they  started? 

A.  I'm  not  sure,  sir. 

Q.  Not  sure  meaning  you  don't  recall  that? 

A.  Meaning  I  don't  recall,  sir. 

Q.  Okay.  Do  you  recall  telling  me  that  you  witnessed  him  help 
others  with  their  DCGS-A  computers? 

A.  Yes,  sir. 

Q.  All  right.  And  we'll  talk  about  that  in  a  moment,  but  when 
he  was  helping  others,  no  one  stepped  in  and  said,  hey,  you  can't  do 
that,  that's  not  permitted? 

A.  Correct,  sir. 

Q.  Now,  you  said  your  computer  would  crash  occasionally? 

A.  Yes,  sir. 
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1  Q.  And  sometimes  I  imagine  when  it  crashed  you  lost 

2  information? 

3  A.  Yes,  sir. 

4  Q.  So  would  you  agree  with  me  that  analysts  were  encouraged  to 

5  save  information  on  the  T-drive? 

6  A.  Yes,  sir. 

7  Q.  And  the  T-drive  was  the  shared  drive  that  everyone  had 

8  access  to? 


9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 
23 


A.  Yes,  sir. 

Q.  And  analysts  were  also  encouraged  if  they  wanted  to  save 
information  on  a  CD? 

A.  Yes,  sir. 

Q.  And,  of  course,  because  it  was  your  computer,  your  DCGS-A 
computer,  you  would  save  information  on  the  desktop  of  your  computer 
if  you  wanted? 

A.  Yes,  sir. 

Q.  That  was  permitted? 

A.  Yes,  sir. 

Q.  Now,  I  want  to  talk  about  some  of  the  times  you  witnessed 

others  being  helped  by  PFC  Manning  on  the  DCGS-A  computer,  okay? 

A.  Yes,  sir. 

Q.  Now,  the  first  time  —  well,  actually  one  of  the  times  was 
dealing  with  mIRC  chat,  is  that  correct? 
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A.  Yes,  sir. 

Q.  And  mIRC  chat  is  one  of  those  baseline  programs  that  you 
didn't  have  on  your  DCGS-A  computer,  right? 

A.  Correct,  sir. 

Q.  But  analysts  needed  mIRC  chat  to  do  their  job? 

A.  Correct. 

Q.  And  that's  because  you  as  an  analyst  in  the  S-2  section 
would  speak  to  others  who  were  using  mIRC  chat? 

A.  Correct. 

Q.  So  do  you  recall  having  PFC  Manning  set  up  mIRC  chat  on 
your  computer? 

A.  Yes,  sir. 

Q.  And  do  you  recall  him  doing  that  for  others? 

A.  Yes,  sir. 

Q.  And  mIRC  chat,  when  you  did  that,  it  was  put  on  your 
computer  basically  as  something  that  you  would  double  click  to  start 
on  the  desktop? 

A.  Yes,  sir. 

Q.  And  you're  sure  PFC  Manning  did  this  and  not  Mr.  Milliman? 

A.  Yes,  sir. 

Q.  And  when  PFC  Manning  did  this  for  you  and  others,  did 
anyone  step  in,  to  your  memory,  and  say,  hey,  that's  not  permitted? 

A.  No,  sir. 
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Q.  Now,  at  Fort  Drum  you  attended  DCGS-A  training  with  PFC 
Manning? 


A.  Correct. 

Q.  And  do  you  recall  who  taught  this  training  to  you? 

A.  I  do  not,  sir. 

Q.  Does  MIT  teams  sound  correct  to  you? 

A.  Yes,  sir,  it  would. 

Q.  And  do  you  recall  what  a  MIT  team  was? 

A.  No,  I  don't. 

Q.  Did  you  ever  receive  any  training  on  what  you  could  and 
could  not  add  on  the  desktop  of  your  DCGS-A  computer? 

A.  Not  that  I  recall. 

Q.  And  just  for  the  judge,  I  want  to  make  sure  it's  not  that 
you  recall,  meaning  I  can't  remember  if  we  did,  or  I  don't  remember 
we  ever  did  receive  that  training? 

A.  Yeah.  I  don't  remember,  sir. 

Q.  All  right.  Did  you  ever  receive  any  training  discussing 
what  you  could  and  could  not  place  on  your  desktop  like  mIRC  chat, 
like  an  executable  file? 

A.  No,  I  do  not. 

Q.  And,  again,  is  that  you  don't  remember  that,  or  you  don't 
believe  you  received  that  training? 

A.  I  don't  believe  we  received  that  training. 
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1  Q. 

Okay.  And  during  the  deployment  did  anyone  say  to  you  that 

2  you  could 

not  put  mIRC  chat  on  your  desktop  as  an  executable  file? 

3  A. 

No,  they  did  not. 

4  Q. 

Did  you  receive  any  training  either  at  Fort  Drum  or  during 

5  the  deployment  on  how  you  had  to  download  information  from  the 


6  SIPRNET? 

7  A. 

Not  that  I  remember,  sir. 

00 

O 

Was  there  any  formal,  you  know,  guidance  or  statement  to 

9  you  that  you  had  to  download  information  in  one  particular  way,  like 
10  click,  open,  save? 


11  A. 

No. 

12  Q. 

Do  you  know  what  exporting  with  Excel  is? 

13  A. 

Yes,  sir. 

14  Q. 

And  could  you  tell  the  judge  what  that  is? 

15  A. 

You'd  take  a  document  and  export  it  into  Excel,  is  that  the 

16  one  you're  - 


17  Q. 

Yes. 

18  A. 

And  then  it  would  make  a  sheet  for  you  where  it  would  list 

19  everything  to  like  upload  grid  coordinates  into  an  ARC  map  or 

20  something,  as  an  example. 

21  Q.  And  when  you  were  exporting  large  documents,  like  if  you 

22  were  exporting  a  month  of  SIGACTs  or  something  to  Excel,  did  you  have 
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to  click,  open  and  save  every  one  of  the  SIGACTs  or  would  the  Excel 
export  it  for  you? 

A.  The  Excel  would  export  it  for  us. 

So  it  would  do  it  automatic  —  in  an  automated  fashion. 
Yes,  sir. 

Is  that  correct? 

Yes,  sir. 

Did  anyone  tell  you  that  that  was  improper,  that  you're 
supposed  to  go  and  click,  open  and  save  and  not  use  the  automated 
process? 


Q. 

A. 


A. 

Q. 


Q.  And  from  your  memory,  was  that  permitted? 

A.  Yes,  sir. 

Q.  Now,  you  were  a  part  of  the  advance  party  for  Bravo  Company 
going  to  Iraq.  Is  that  right? 

A.  Correct. 

Q.  And  if  I'm  correct,  you  departed  Fort  Drum  sometime  in 
October  of  2009? 

A.  Yes,  sir. 

Q.  And  then  you  arrived  at  FOB  Hammer  around  the  15th  of 
October? 

A.  Yes,  sir. 


8031 


o 


9 


1  Q. 

And  when  you  arrived,  you  worked  periodically  in  the  SCIF. 

2  Is  that 

right? 

3  A. 

Right . 

4  Q. 

You  also  had  to  support  your  company's  operations? 

5  A. 

Correct . 

6  Q. 

So  initially  you  did  not  work  full-time  in  the  SCIF? 

7  A. 

That's  correct. 

8  Q. 

And  when  you  were  in  the  SCIF,  you  worked  as  an 

9  Intelligence  Analyst? 


10  A. 

Correct . 

11  Q. 

And  I  believe  you  said  you  were  on  the  Shia  threat  group? 

12  A. 

Yes,  sir. 

13  Q. 

And  obviously  PFC  Manning  was  also  on  that? 

14  A. 

Yes . 

15  Q. 

And  at  the  start  of  the  deployment  you  worked  the  day 

16  shift? 


17  A. 

Yes . 

18  Q. 

And  PFC  Manning  worked  the  night  shift? 

19  A. 

Yes,  sir. 

20  Q. 

Now,  on  the  night  shift  PFC  Manning  had  certain  tasks  that 

21  he  was. 

I  guess  had  to  complete.  Is  that  correct? 

22  A. 

Correct . 
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Q.  And  he  and  the  other  night  shift  analysts  were  tasked  to 
complete  and  update  what  I  believe  was  called  a  commander's  read  book 
each  night.  Is  that  right? 

A.  Yes,  that's  correct. 

Q.  And  he  also  had  to  do  a  report  slide  that  was  due  every 
night? 

A.  Yes. 

Q.  And  for  the  slide  PFC  Manning  and  others  had  to  do 
analysis? 


A.  Correct. 

Q.  And  that  slide  was  due  every  night  at  midnight? 

A.  Yes,  sir. 

Q.  And  these  were  products  that  he  was  required  to  complete? 
A.  That's  correct. 

Q.  Now,  at  any  point  when  you  were  working  in  the  T-SCIF,  did 
they  put  out  any  formal  training  on  the  rules  and  regulations  of  the 


SCIF? 


A.  Not  that  I  recall,  sir. 

Q.  So  when  you  say  again  —  when  you  say  not  that  you  recall, 
meaning  they  could  have  and  I  don't  remember  it,  or  I  don't  believe 
they  ever  did  that? 

A.  They  could  have  and  I  don't  remember  it. 
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Q.  From  your  memory,  did  you  ever  see  Soldiers  listening  to 
music  in  the  SCIF? 

A.  Yes. 

Q.  And  where  was  this  music  stored? 

A.  It  was  stored  on  the  T-drive. 

Q.  And  that  was  a  classified  drive,  correct? 

A.  Correct. 

Q.  Did  you  ever  see  the  Soldiers  place  that  music  on  their 
DCGS-A  computers? 

A.  I  didn't  see  them  place  it  on  the  DCGS-A  computers,  no. 

Q.  Did  you  ever  see  the  Soldiers  listening  to  the  music  on  the 

DCGS-A  computers? 

A.  Yes,  sir. 

Q.  Did  you  ever  see  movies  in  the  T-SCIF? 

A.  Yes,  sir. 

Q.  And  did  you  ever  see  Soldiers  playing  movies  in  the  T-SCIF? 
A.  Yes. 

Q.  Did  you  ever  see  games  being  played  in  the  T-SCIF? 

A.  Yes,  sir. 

Q.  Video  games?  And  were  these  being  played  on  the  DCGS-A 
computer? 

A.  Yes,  sir. 
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Q.  And  from  your  memory,  was  anyone  ever  punished  for  having 
games,  music  or  movies  in  the  T-SCIF? 

A.  No. 

Q.  And  we  talked  about  the  fact  that  others  had  had  mIRC  chat 
added  on  to  their  desktop  computer,  right? 

A.  Yes. 

Q.  Was  anyone  ever  punished  for  having  mIRC  chat  put  on  their 
desktop? 


Q.  Did  anyone  ever  say  that  that  was  wrong? 

A.  No. 

CDC [MR.  COOMBS]:  All  right.  Thank  you. 

MJ:  Redirect? 

ATC [CPT  WHYTE]:  Yes,  ma'am,  just  a  few  questions. 

REDIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  WHYTE] : 

Q.  Mr.  Madaras,  you  said  that  PFC  Manning  helped  other 
Soldiers  with  their  DOGS  machines? 

A.  Yes. 

Q.  How  did  he  help  the  other  Soldiers? 

A.  From  all  I  can  remember  was  helping  with  mIRC  chat. 
Q.  And  why  was  he  asked  to  help  the  Soldiers? 
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A.  Because  we  needed  mIRC  chat  so  we  could  talk  to  other  units 
at  other  FOBs . 

Q.  So  let's  talk  about  mIRC  chat.  You  said  you  had  it  on  your 
DCGS  machine? 

A.  Yes,  sir. 

Q.  Where  was  it  located  on  your  machine? 

A.  Right  off  the  desktop. 

Q.  Okay.  And  who  else  had  mIRC  chat  on  their  computer? 

A.  Everybody  did,  sir. 

Q.  In  the  S-2  shop? 

A.  Yes,  sir. 

Q.  What  about  outside  of  the  S-2  shop? 

A.  Anybody  that  worked  in  direct  relation  to  us  like  current 
ops  at  other  units  and  their  S-2s  at  other  units  all  had  mIRC  chat. 

Q.  Can  you  explain  for  the  Court  what  mIRC  chat  looks  like 
when  you  actually  open  it  up? 

A.  When  you  open  it  up  there's  a  bunch  of  listings  on  the  left 
side  of  the  screen  that  has  all  the  different  chat  groups  in  it.  In 
the  center  it's  a  blank  space  so  when  you  click  to  it  it  opens  it  up 
so  you  can  see  that  group,  and  at  the  bottom  is  where  you  type  in 
what  you  want  to  say. 

Q.  And  what  type  of  information  was  communicated  over  mIRC 

chat? 
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A.  Mainly  SIGACTs  that  was  currently  happening  before  they 
were  even  published  on  the  CPOF. 


Q. 

So  why  was  this  information  communicated  over  mIRC  chat? 

A. 

Because  the  sooner  we  would  know  about  stuff,  the  more 

effect  we  could  have  on  the  battle  you  could  say. 

Q.  You  said  that  mIRC  chat  was  stored  on  the  T-drive.  Is  that 
correct? 


A. 

Yes,  sir. 

Q. 

Do  you  know  when  mIRC  chat  was  put  on  the  T-drive? 

A. 

I  don't.  It  was  already  on  there  from  the  previous  unit 

when  we 

got  in  country. 

Q. 

And  then  the  defense  asked  you  about  the  Excel  export 

issue . 

Did  CIDNE,  the  program  itself,  allow  you  to  export  SIGACTs? 

A. 

Yes,  sir,  you  could  then  pour  them  directly  into  Excel. 

Q. 

And  also  movies,  music,  games,  that  was  also  asked  by  the 

defense . 

Do  you  know  when  that  information  was  put  on  the  T-drive? 

A. 

That  was  on  the  T-drive  from  the  previous  unit. 

ATC [CPT  WHYTE]:  No  further  questions.  Your  Honor 

MJ:  Go  ahead. 

CDC[MR.  COOMBS]:  Just  one  follow-up. 

[END  OF  PAGE] 
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1  RECROSS-EXAMINATION 

2  Questions  by  the  civilian  defense  counsel  [MR.  COOMBS] : 

3  Q.  The  DCGS-A  computer,  did  anyone  besides  Intelligence 

4  Analysts  have  DCGS-A  computers? 

5  A.  I  do  not  know,  sir. 

6  Q.  Were  DCGS-A  computers,  computers  that  were  part  of  what  you 

7  did  as  Intelligence  Analysts? 

8  A.  Yes,  sir. 

9  Q.  Would  a  person  who  didn't  have  a  job  that  dealt  with 

10  Intelligence  Analysts  be  working  off  a  DCGS-A  computer? 

11  A.  No,  sir. 

12  CDC [MR .  COOMBS]:  Thank  you. 

13  MJ:  Any  last  redirect? 

14  ATC [CPT  WHYTE]:  No,  ma'am. 

15  MJ:  Mr.  Madaras,  I  have  a  few  questions. 

16  EXAMINATION  BY  THE  COURT-MARTIAL 

17  Questions  by  the  military  judge : 

18  Q.  The  DCGS-A  computers  that  were  down  range,  you  testified 

19  earlier  there's  a  T-drive  and  that  T-drive  stored  mIRC  chat. 

20  A.  Yes,  ma'am. 

21  Q.  So  the  T-drive  was  accessible  to  all  users,  but  were  your 

22  individual  user  drives  or  your  user  profiles  accessible  to  your 

23  colleagues? 
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A.  If  we  saved  them  on  to  the  T-drive  they  were,  ma'am. 

Q.  So  did  you  —  You  said  —  you  testified  PFC  Manning  helped 

you  install  mIRC  chat  on  your  desktop.  Was  that  as  a  shortcut  from 
the  T-drive? 

A.  That  would  be  as  a  shortcut,  ma'am,  yes,  from  my 
understanding . 

Q.  Was  there  a  separate  mIRC  chat  on  your  user  profile  as 

well? 

A.  I  do  not  know. 

Q.  When  you  used  mIRC  chat,  where  did  you  use  it  from? 

A.  Right  off  my  desktop. 

Q.  You  testified  earlier  that  music,  books  and  games  were 
already  on  the  T-drive  from  the  previous  unit.  Did  any  of  the 
members  of  the  SCIF,  are  you  aware,  did  anybody  put  new  movies,  games 
or  videos  on  the  T-drive? 

A.  Not  that  I  know  of,  no. 

Q.  Do  you  know  if  there  was  any  authorization  or  prohibition 
from  —  any  authorizing  to  do  that  --  authorization  to  do  that  or 
prohibition  against  doing  that? 

A.  No,  ma'am,  I  do  not  know. 

Q.  So  there  was  basically  silence  on  the  issue? 

A.  Correct. 

Q.  Who  supervised  you? 
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A. 

Kyle  Balonek  did. 

Q. 

Would  Mr.  Balonek  have  been  aware  if  someone  was  watching  - 

-  of  people  watching  these  movies  and  playing  these  games  from  the  T 
drive . 


A. 

Yes,  I  would  believe  so. 

Q. 

When  you  testified  earlier  that  Mr.  Milliman  I  believe  his 

name  was 

would  come  and  help  you  fix  the  computer  problems  that  you 

had  when 

you  had  them? 

A. 

Yes. 

Q. 

Did  —  And  he  would  re-image  them  to  do  that.  Is  that  what 

you  said? 


A. 

Yes,  that's  correct. 

Q. 

When  someone  re-images  a  computer,  what  happens  to  the  data 

that  you 

have? 

A. 

Wipes  —  From  my  understanding  it  gets  rid  of  everything 

like  starting  fresh. 

Q.  So,  if  you  needed  —  Were  you  ever  in  a  situation  where  you 
needed  data  from  your  computer  before  it  was  re-imaged? 


A. 

Yes. 

Q. 

What  did  you  do  with  that  data? 

A. 

We'd  save  it  to  a  CD. 

Q. 

And  what  would  you  do  with  the  CD? 

8040 


© 


J 


1  A.  It  would  go  into  the  computer  again  once  he  was  done  re- 

2  imaging  it  and  re-save  all  the  files  to  the  computer  that  were 

3  needed,  ma'am. 

4  Q.  Now,  when  the  computer  is  re-imaged,  does  it  strip  data 

5  from  the  T-drive,  too? 

6  A.  No.  The  T-drive  was  a  completely  separate  function. 

7  Q.  So  the  re-imaging  would  just  be  for  your  user  profile? 

8  A.  Just  for  the  computer,  anything  that  was  saved  on  that 

9  computer's  hard  drive. 

10  Q.  So  the  T-drive  is  a  shared  drive  located  somewhere  else? 

11  A.  Correct. 

12  Q.  If  the  computers  would  go  down  frequently,  why  would  you 

13  not  save  everything  on  the  T-drive? 

14  A.  We  usually  tried  to  save  most  everything  that  we  were 

15  working  on  on  the  T-drive,  ma'am. 

16  Q.  You  testified  earlier  that  you  didn't  do  any  searches  of 

17  Europe  and  Iceland  and  all  of  the  other  areas  that  you  talked  about 

18  because  it  wasn't  in  your  particular  area  of  operations.  What's  your 

19  understanding  of,  say  you  had  down  time,  instead  of  watching  a  movie, 

20  you  wanted  to  see  what  was  going  on  in  the  world,  for  example.  What 

21  is  your  understanding  of  what  the  policy,  if  any,  was  with  respect  to 

22  you  searching  things  that  didn't  have  anything  to  do  with  your  AO? 

23  A.  I  don't  believe  there  was  any  stipulation  against  doing  so. 


8041 


Q 


J 


1  MJ:  Any  questions  based  on  mine? 

2  CDC [MR.  COOMBS]:  No,  Your  Honor. 

3  TC [MAJ  FEIN]:  No,  Your  Honor. 

4  M J:  All  right.  Anything  else  for  this  witness? 

5  ATC [CPT  WHYTE]:  No,  ma'am. 

6  MJ:  All  right. 

7  [The  witness  was  temporarily  excused,  duly  warned,  and  withdrew  from 

8  the  courtroom . ] 

9  MJ:  All  right.  Counsel,  I'm  looking  at  the  time,  I'm  also 

10  looking  at  a  stack  of  stipulations  of  expected  testimony  that  I  have 

11  here.  Would  this  be  a  good  time  to  go  through  the  stipulations  of 

12  expected  testimony  with  PFC  Manning  and  then  break  for  a  lunch,  or 

13  would  you  rather  break  for  lunch  and  then  go  through  it  afterwards? 

14  TC [MAJ  FEIN]:  Ma'am,  the  United  States  recommends  that  we  break 

15  for  lunch,  for  a  2-hour  lunch  recess  because  we  have  more 

16  stipulations  and  then  we  can  put  them  all  together  and  do  them  at  one 

17  time  after  lunch. 


18 

MJ:  Any  objection 

to  that? 

19 

CDC [MR.  COOMBS]: 

No,  Your  Honor. 

20 

MJ:  Anything  else 

we  need  to  address  before  we  go  into  a  2-hour 

21 

recess? 

22 

TC [MAJ  FEIN]:  No, 

ma'am. 

23 

CDC [MR.  COOMBS]: 

No,  ma'am. 
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M J :  All  right.  Court  will  reconvene  then  at  1400  or  2  o'clock. 
Court  is  in  recess. 

[The  court-martial  recessed  at  1211,  10  June  2013.] 

[The  court-martial  was  called  to  order  at  1524,  10  June  2013.] 

MJ:  Court  is  called  to  order.  Major  Fein? 

TC [MAJ  FEIN]:  Yes,  ma'am.  All  parties  when  the  Court  last 
recessed  are  again  present,  Your  Honor,  with  the  following  exception 
Captain  Whyte  is  absent  and  Captain  Overgaard  is  present. 

MJ:  All  right.  During  the  lunch  recess  that  went  a  little  bit 

longer,  or  a  lot  longer  than  we  had  planned.  The  parties  have 
presented  me  with  some  stipulations  of  expected  testimony  that  both 
sides  have  agreed  to  and  that  PFC  Manning  has  agreed  to.  I  count  a 
total  of  19.  Do  both  sides? 

TC [MAJ  FEIN]:  Yes,  ma'am. 

ADC [MAJ  HURLEY] :  Yes,  ma'am. 

TC [MAJ  FEIN]:  And,  ma'am,  that's  19,  one  classified,  and  then 
there's  an  unclassified  redacted  version  as  well,  but  it's  the  same. 

MJ:  Major  Hurley,  I  need  to  go  over  these  stipulations  with  PFC 
Manning.  Does  he  have  them  in  order  of  appellate  exhibit  number? 

ADC [MAJ  HURLEY]:  Ma'am,  he  has  them  in  order  of  prosecution 

exhibits  numbers. 

MJ:  I'm  sorry,  prosecution  exhibit  number.  Excuse  me. 
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ADC [MAJ  HURLEY]  Yes,  ma'am.  May  we  wait  a  second  just  to 

make  sure  that's  right. 

MJ:  Yeah.  I  will  do  it  any  order  you  would  like.  I  can  do  it 

alphabetically,  I  can  do  it  by  appellate  exhibit  [sic]  or  whatever 
makes  sense  to  you  will  make  sense  to  me. 

ADC [MAJ  HURLEY]:  Ma'am,  I  apologize.  What  we've  done  is 

we've  set  them  up  in  order  of  the  witness  testimony  according  to  the 
witness  list  proposed  by  the  government.  So  that's  the  order  that 
they're  currently  in  now. 

MJ:  Will  it  be  faster  for  you  all  to  just  take  my  copies  and 

match  them  to  his  order? 

ADC [MAJ  HURLEY]:  Ma'am,  I  think  it  will  be  faster  if  we  took 

our  copies  and  matched  them  to  the  prosecution  ID  numbers. 

MJ:  All  right. 

[There  was  a  brief  pause  while  the  defense  counsel  and  accused 
reviewed  the  prosecution  exhibits . ] 

ADC [MAJ  HURLEY]:  Ma'am,  we  did  our  best. 

MJ:  Thank  you.  PFC  Manning,  the  one  question  I  do  want  to  ask 

you  before  we  begin  our  colloquy,  is  there's  19  of  these  stipulations 
of  expected  testimony  and  as  I  hold  them  in  my  hand  they  can  be  the 
size  basically  of  a  small  paperclip  that  could  hold  them  together. 
Have  you  had  an  opportunity  to  read  each  one  of  these  19 
stipulations,  and  do  you  feel  like  you  have  had  enough  time  to  go 
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through  all  of  these  that  you  are  comfortable  having  that  colloquy 
now? 

ACC:  Yes,  ma'am,  definitely. 

MJ:  I  know  some  are  dated  7  June  and  some  are  dated  9  and  10 

June,  and  I  just  noticed  here  on  my  copy  at  least  of  the  redacted 
classified  version  doesn't  have  a  date.  My  copy  of  June,  is  that  for 
a  reason? 

TC[MAJ  FEIN]:  No,  ma'am,  the  original  classified  version  is 
dated  10  June. 

MJ:  Okay.  So  the  redacted  version  will  be  10  June  too? 

ADC [MAJ  HURLEY]:  Yes,  ma'am. 

MJ:  Now  that  we're  looking  at  that  one,  I  also  was  advised  by 

the  parties  who  came  into  my  office  briefly  for  an  R.C.M.  802 
conference  that  lasted  about  2  minutes,  that  a  couple  of  these 
stipulations,  and  this  is  —  let's  look  at  the  one  for  Lieutenant 
Commander  Hoskins,  the  redacted  copy  of  111B,  on  Page  2.  If  you  look 
in  Paragraph  8.  It  has  Prosecution  Exhibit  and  then  it's  handwritten 
87  for  Identification.  The  parties  advised  me  in  the  802  conference, 
normally  when  you  have  stipulations  of  expected  testimony  and  you 
made  handwritten  notes  or  changes  on  it,  PFC  Manning,  you  would 
initial  it,  and  the  government  would  initial  it;  but  this  looks  like 
it  was  just  added  as  part  of  the  original  stipulation.  Is  that  the 
understanding  of  the  parties? 
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ADC [MAJ  HURLEY]:  Yes,  ma'am,  we  received  them  from  the 

government,  they  had  already  handwritten  in  the  prosecution  exhibit 
the  time  we  reviewed  it  and  signed  it. 

MJ:  That  is  correct. 

TC [MAJ  FEIN]:  Yes,  ma'am. 

MJ:  And  PFC  Manning  Do  you  agree? 

ACC:  Yes,  ma'am. 

MJ:  All  right.  So  basically  you  had  the  stipulations,  you  just 

didn't  know  what  the  appellate  exhibit  [sic]  number,  or  the  ones  we 
were  referring  to  were  at  that  particular  time. 

ADC [MAJ  HURLEY]:  Yes,  ma'am.  As  we  were  going  back  and  forth 

on  content  and  then  once  we  got  down  to  the  specifics  that's  when  it 
was  actually  filled  in  prior  to  signature. 

MJ:  Okay.  Does  either  side  see  a  necessity  to  go  through  and 

initial  these? 

ADC [MAJ  HURLEY]:  The  defense  does  not,  ma'am. 

TC [MAJ  FEIN]:  No,  ma'am,  not  for  all  my  people. 

MJ:  All  right.  Let's  —  Again,  let's  just  go  through  them  one- 

by-one  to  make  sure  we're  both  talking  about  the  same  thing.  I  have 
Prosecution  Exhibit  70  for  Identification,  which  is  stipulation  of 
expected  testimony  from  Mr.  Peter  Artale.  Is  it  Artail  or  Artale? 

TC [MAJ  FEIN]:  Artale,  ma'am. 

MJ:  Artale.  And  PFC  Manning  do  you  have  that  one? 
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ACC:  Yes,  ma'am. 

MJ:  And  the  second  one  I  have  is  a  Mr.  Sean  Chamberlin.  Do  you 
have  that  one  as  Prosecution  Exhibit  71. 

ACC:  Yes,  Your  Honor. 

MJ:  The  next  one  I  have  is  a  stipulation  of  expected  testimony 

of  Special  Agent  John  Wilbur,  which  is  Prosecution  Exhibit  72  for 
Identification . 

ACC:  Yes,  Your  Honor. 

MJ:  All  right.  The  next  one  is  James  Fung,  Prosecution  Exhibit 

73  for  Identification. 

ACC:  Yes,  Your  Honor. 

MJ:  All  right.  The  next  one  is  Alex  Withers,  Prosecution 

Exhibit  74  for  Identification. 

ACC:  Yes,  ma'am. 

MJ:  All  right.  Mr.  James  McManus,  7  June  2013,  Prosecution 

Exhibit  75  for  Identification. 

ACC:  Yes,  Your  Honor. 

MJ:  The  next  one  is  Special  Agent  Troy  Bettencourt,  Prosecution 
Exhibit  76  for  Identification. 

ACC:  Yes,  ma'am. 

MJ:  All  right.  The  next  one  is  Special  Agent  Kirk  Ellis 

Prosecution  Exhibit  77  for  Identification. 

ACC:  Yes,  ma'am. 


8047 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


© 


0 


MJ:  All  right.  The  next  one  is  Special  Agent  Mark  Mander, 

Prosecution  Exhibit  78  for  Identification. 

ACC:  Yes,  ma'am. 

MJ:  Next  is  one  is  Mr.  Doug  Schasteen,  Prosecution  Exhibit  80 

for  Identification. 

ACC:  Yes,  ma'am. 

MJ:  The  next  one  I  have  is  Prosecution  Exhibit  106  for 

Identification,  Mr.  Jacob  Grant. 

ACC:  Yes,  Your  Honor. 

MJ:  All  right.  The  next  one  Ms.  Florinda  White  Prosecution 

Exhibit  107  for  Identification. 

ACC:  Yes,  Your  Honor. 

MJ:  All  right.  The  next  one  is  Lieutenant  Commander  Thomas 

Hoskins,  U.S.  Navy  Reserve,  Prosecution  Exhibit  111B,  Bravo. 

ACC:  Yes,  Your  Honor. 

MJ:  Next  one  is  Lieutenant  Colonel  retired  Martin  Nehring, 

Prosecution  Exhibit  112  for  Identification. 

ACC:  Yes,  ma'am. 

MJ:  Next  one  is  Debra  van  Alstyne,  Prosecution  Exhibit  113  for 

Identification. 

ACC:  Yes,  Your  Honor. 

MJ:  Next  one  is  Mr.  Wyatt  Bora,  Prosecution  Exhibit  115  for 

Identification. 


8048 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


o 


9 


ACC:  Yes,  Your  Honor. 

MJ:  Next  one  I  have  is  Mr.  Patrick  Hoeffel.  Is  that  how  you 

pronounce  his  name? 

TC [MAJ  FEIN]:  Yes,  ma'am. 

MJ:  And  that  would  be  Prosecution  Exhibit  116  for 

Identification. 

ACC:  Yes,  Your  Honor. 

MJ:  All  right.  And  then  I  have  CW5  Jon  LaRue,  Prosecution 

Exhibit  117  for  Identification. 

ACC:  Yes,  Your  Honor. 

MJ:  And  then  I  have  Ms.  Jacqueline  Scott,  she  should  have  come 

before  LaRue,  but  Ms.  Jacqueline  Scott  which  is  Prosecution  Exhibit 
116  for  Identification. 

ACC:  I  have  119. 

MJ:  Oh,  okay.  It  looked  like  a  6  to  me .  Again,  119  for 

Identification.  Is  that  right? 

TC [MAJ  FEIN]:  Yes,  ma'am. 

MJ:  Okay.  Do  you  have  any  other  stipulations  of  expected 

testimony  before  you  that  I  haven't  referenced? 

ACC:  No,  ma'am. 

MJ:  And  once  again,  before  signing  each  of  these  stipulations  - 

-  first  of  all,  are  the  signatures  on  the  back  of  each  of  these 
stipulations . 
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ACC:  Yes,  ma'am,  except  for  the  redacted  one. 

MJ:  Okay.  Is  your  signature  on  the  back  of  the  original? 

ACC:  Yes. 

MJ:  And  that  would  be  for  the  record  Prosecution  Exhibit  111 

Bravo,  Lieutenant  Commander  Thomas  Hoskins. 

ADC [MAJ  HURLEY]:  Yes,  ma'am.  Bravo  is  what  we  have  redacted 

and  Alpha  is  the  original. 

MJ:  All  right. 

TC [MAJ  FEIN]:  And,  ma'am,  we  do  have  Alpha  for  you  if  you'd 
like  to  look  at  it  right  now. 

MJ:  Let  me  just  —  before  we  begin,  let  me  look  at  that  one. 

Has  PFC  Manning,  has  he  had  an  opportunity  to  look  at  111  Alpha? 

ADC [MAJ  HURLEY]:  Yes,  ma'am,  he  has. 

MJ:  All  right.  Why  don't  you  give  it  to  me  just  so  I  can  see 

it. 

TC [MAJ  FEIN]:  May  I  approach.  Your  Honor? 

MJ:  Yes.  I'm  looking  at  a  copy  of  what's  been  marked  as 

Prosecution  Exhibit  111  Alpha.  It  looks  like  there  are  redactions, 
PFC  Manning,  at  the  top  and  bottom  of  each  page,  but  the  substantive 
redaction  that  I  want  to  talk  about  with  you  is  Paragraph  16, 
redacted  in  the  redacted  copy.  Have  you  had  an  opportunity  to  review 
the  Paragraph  16  in  the  original  exhibit? 

ACC:  Yes,  Your  Honor. 
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1  MJ:  You've  had  the  opportunity  to  thoroughly  read  that? 

2  ACC:  Yes,  that's  correct. 

3  MJ:  You  can  take  that  back.  PFC  Manning,  with  each  of  these 

4  19  stipulations  before  you  signed  them,  did  you  read  them  thoroughly 

5  ACC:  Yes. 

6  MJ:  Do  you  understand  the  contents  of  the  stipulations. 

7  ACC:  Yes,  ma'am. 

8  MJ:  Do  you  agree  with  the  contents  of  the  stipulations. 

9  ACC:  Yes,  Your  Honor. 

10  MJ:  All  right.  Now,  before  signing  the  stipulations,  did  your 

11  defense  counsel  explain  the  stipulations  to  you? 

12  ACC:  Yes,  Your  Honor. 

13  MJ:  Do  you  understand  you  have  an  absolute  right  to  refuse  to 

14  stipulate  to  the  contents  of  the  documents? 

15  ACC:  Yes,  Your  Honor. 

16  MJ:  And  that  you  should  stipulate  to  them  only  if  you  believe 

17  it's  in  your  best  interest  to  do  that. 

18  ACC:  Yes,  Your  Honor. 

19  MJ:  Once  again,  all  of  these  are  stipulations  of  expected 

20  testimony,  which  means  that  if  counsel  from  both  sides  and  you  agree 

21  to  stipulations  of  expected  testimony,  you're  agreeing  that  each  of 

22  these  19  witnesses  if  they  were  sitting  here  in  the  witness  stand 

23  today  they  would  testify  substantially  as  what's  in  the  stipulation 
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1  of  expected  testimony  that's  geared  to  them  and  if  they  were  under 

2  oath  that's  exactly  how  they  would  testify?  You're  not  agreeing  to 

3  the  truth  of  what  they're  saying.  Their  stipulation  and  their 

4  testimony  can  be  —  Their  stipulations  can  be  attacked  the  same  way 

5  that  if  the  person  was  testifying  here  live.  They  can  be 

6  contradicted  and  they  can  be  explained  in  the  same  way  as  if  they 

7  were  here  testifying  here  in  live  and  in  court  today.  Do  you 

8  understand  that? 

9  ACC:  Yes,  Your  Honor. 

10  MJ:  And  knowing  what  I've  told  you  earlier  and  what  your 

11  defense  counsel  has  told  you  and  what  I've  told  you  today,  do  you 

12  still  desire  to  enter  into  these  stipulations? 

13  ACC:  Yes,  Your  Honor. 

14  MJ:  Do  counsel  concur  with  the  contents  of  each  of  these  19 

15  stipulations? 

16  ADC [MAJ  HURLEY] :  Yes,  ma'am. 

17  TC [MAJ  FEIN]:  Yes,  ma'am. 

18  MJ:  All  right.  Shall  I  admit  them  as  evidence  now  or  as  we  go 

19  through? 

20  TC[MAJ  FEIN]:  Ma'am,  we  can  admit  now  and  then  we  will  read 

21  them  as  we  go  through. 

22  MJ:  All  right.  Why  don't  you  hand  them  to  me?  Would  it  help 

23  to  have  my  copies? 
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ADC [MAJ  HURLEY] :  Yes,  ma'am. 

MJ:  Thank  you.  All  right.  Prosecution  Exhibit  70  for 

Identification  a  stipulation  of  expected  testimony  of  Mr.  Peter 
Artale  is  admitted.  Prosecution  Exhibit  71  for  Identification  the 
stipulation  of  expected  testimony  of  Mr.  Sean  Chamberlin  is  admitted. 
Prosecution  Exhibit  72,  Special  Agent  John  Wilbur,  for  Identification 
is  admitted. 

I'm  not  going  say  stipulation  of  expected  testimony  with 
each  of  these.  I'll  just  say  the  name.  Prosecution  Exhibit  73  for 
Identification,  Mr.  John  --  James  Fung  is  admitted.  Prosecution 
Exhibit  74,  Mr.  Alex  Withers,  is  admitted.  Prosecution  Exhibit  75, 
Mr.  James  McManus,  is  admitted.  Prosecution  Exhibit  76,  Special 
Agent  Troy  Bettencourt,  is  admitted.  Prosecution  Exhibit  77,  Special 
Agent  Kirk  Ellis,  is  admitted.  Prosecution  Exhibit  78,  Special  Agent 
Mark  Mander,  is  admitted.  Prosecution  Exhibit  79,  Mr.  Doug 
Schasteen,  is  admitted.  Wait  a  minute. 

CDC [MR.  COOMBS:  Ma'am,  that's  Prosecution  Exhibit  80. 

MJ:  That  is  Prosecution  Exhibit  80.  Why  do  I  have  79  here?  79 

I  should  not  have.  Prosecution  Exhibit  79  is  not  admitted.  Mr. 

Doug  Schasteen,  Prosecution  Exhibit  80  for  Identification  is 
admitted.  Prosecution  Exhibit  106,  Mr.  Jacob  Grant,  is  admitted. 
Prosecution  Exhibit  107,  Ms.  Florinda  White,  is  admitted. 

Prosecution  Exhibits  111  Alpha,  which  is  the  classified  version. 
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which  I  can  initial  later  or  on  a  recess,  and  Prosecution  Exhibit  111 
B  for  Identification  are  admitted.  Prosecution  Exhibit  112, 
Lieutenant  Colonel  retired  Martin  Nehring,  is  admitted.  Prosecution 
Exhibit  113,  Ms.  Debra  van  Alstyne,  is  admitted.  Prosecution  Exhibit 
115,  Mr.  Wyatt  Bora,  is  admitted.  Prosecution  Exhibit  116,  Mr. 
Patrick  Hoeffel,  is  admitted.  Prosecution  Exhibit  117,  CW5  John 
LaRue,  is  admitted.  And  Prosecution  Exhibit  119,  Ms.  Jacqueline 
Scott,  is  admitted. 

Let  the  record  reflect  I'm  handing  all  of  those  exhibits 
back  to  the  court  reporter.  Is  there  anything  that  we  need  to 
address  before  we  proceed? 

TC [MAJ  FEIN]:  No,  Your  Honor. 

ADC [MAJ  HURLEY] :  No,  ma'am. 

MJ:  Government,  call  your  next  witness. 

ATC [CPT  MORROW]:  United  States  calls  Special  Agent  Mark 

Mander . 

SPECIAL  AGENT  MARK  MANDER,  U.S.  ARMY,  was  called  as  a  witness  for  the 
prosecution,  was  sworn,  and  testified  as  follows: 

DIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  You  are  Special  Agent  Mark  Mander? 

A.  Yes. 

Q.  At  the  Computer  Crimes  Investigate  Unit,  Army  CID? 
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A.  Yes. 

Q.  Agent  Mander,  how  long  have  you  been  a  CID  Agent? 

A.  I've  been  an  agent  approximately  11  years. 

Q.  And  you  are  a  civilian  agent  at  this  time? 

A.  Yes,  I'm  a  civilian  agent  currently. 

Q.  And  describe  your  career  in  CID  essentially? 

A.  Beginning  in  1994  I  became  a  CID  agent  as  military  or  an 
active  duty  CID  agent,  was  a  military  agent  for  about  4  years,  went 
to  the  Reserves  for  3  years.  I  then  took  a  break  from  both  reserves 
or  any  military  service  until  joining  the  Reserves  again  in  2007,  and 
then  in  2008  I  became  a  civilian  agent  and  was  also  a  reserve  agent 
at  the  same  time. 

Q.  When  did  you  joint  CCIU  specifically? 

A.  I  was  hired  as  a  civilian  agent  in  CCIU  in  February  of 

2008. 

Q.  And  what  training  did  you  receive  to  become  a  CID  agent? 

A.  Beginning  in  1994,  I  went  to  basically  the  CID  School  where 
they  teach  various  aspects  of  being  an  agent. 

Q.  And  what  training  have  you  received  related  to  computer 
crimes  as  part  of  your  CCIU  job? 

A.  Basically  all  the  agents  at  CCIU  go  through  various 
training  courses  at  the  Defense  Cyber  Investigations  Training 
Academy,  or  DCITA.  I've  attended  approximately,  well  over  400  hours 
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1  of  courses  there.  The  courses  range  from  identifying  various 

2  computer  parts  and  software,  doing  analysis  of  computers  imagining  or 

3  obtain  forensic  images  of  computers,  things  of  that  nature. 

4  Q.  What  is  CCIU's  area  of  expertise  in  the  CID  world? 

5  A.  CCIU  is  Army  CID's  investigative  element  that  is 

6  specifically  focused  on  conducting  investigations  involving  computer 

7  intrusions  and  computer  crimes. 

8  Q.  And  what  do  you  mean  by  an  intrusion? 

9  A.  Essentially  there  are  many  instances  or  incidents  where 

10  Army  or  DoD  computer  networks  are  intruded  upon  where  someone  will 

11  remotely  try  to  get  access  or  does  gain  access  and  obviously  that  is 

12  a  crime  that  we  investigate. 

13  Q.  And  do  you  hold  any  certifications  in  computer-related 

14  fields? 

15  A.  Currently  I  hold  a  Department  of  Defense  Certified  Computer 

16  Crime  Investigator  Certification. 

17  Q.  And  approximately  how  many  cases  have  you  investigated  as  a 

18  CCIU  agent? 

19  A.  Probably  in  excess  of  20. 

20  Q.  And  what  about  total  in  your  time  at  CID,  how  many  cases 

21  have  you  investigated? 

22  A.  Probably  in  excess  of  200  cases  where  either  I  was  the 

23  primary  agent  or  I  was  helping  another  agent  on  their  case. 
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1  Q.  Agent  Mander,  I'd  like  to  discuss  the  investigation  of  PFC 

2  Manning  and  WikiLeaks.  What  has  been  —  or  what  was  and  has  been 

3  your  role  been  in  the  investigation  to  date? 

4  A.  When  the  investigation  first  started  essentially  I  was  a 

5  case  agent  in  the  investigation  which  means  I  would  do  various  case 

6  related  investigative  duties. 

7  Q.  And  how  did  this  investigation  compare  to  other 

8  investigations  you've  been  a  part  of  at  CCIU? 

9  A.  For  CCIU  as  well  as  all  of  the  other  investigations  that 

10  I've  participated  as  a  CID  agent.  This  was  probably  one  of  the 

11  largest  and  most  complicated  investigations  we've  ever  had. 

12  Q.  As  a  case  agent,  what  were  you  doing  day-to-day? 

13  A.  My  duties  involved  reviewing  various  documents,  either 

14  classified  documents  or  open-source  documents,  interviewing  personnel 

15  that  had,  you  know,  some  relationship  or  bearing  on  the 

16  investigation,  writing  reports,  collecting  evidence,  coordinating 

17  with  various  other  agencies  and  other  personnel  to  forward  the  case. 

18  Q.  And  what  initially  brought  PFC  Manning  to  law  enforcement's 

19  attention? 

20  A.  Initially  in,  well  towards  the  end  of  May  of  2010,  our 

21  office  received  an  e-mail  that  suggested  a  Soldier  in  Iraq  had  or  was 

22  or  would  be  wrongfully  disclosing  classified  information. 
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Q.  And  what  organization  was  initially  responsible  for  the 
investigation? 

A.  Initially  it  was  Army  CID  was  involved.  It  wasn't  the  CCIU 
initially.  The  case  was  opened  by  a  CID  office  in  Iraq  that  was 
assigned  the  case. 

Q.  And  when  did  the  case  get  transferred  to  CCIU? 

A.  I'm  going  to  say  probably  the  second  week  of  June,  I 

believe  it  was  maybe  the  9th  or  10th  of  June  or  somewhere 
thereabouts . 

Q.  Aside  from  the  computer  nexus,  why  was  the  case  transferred 
to  CCIU  and  your  office  specifically  in  the  United  States? 

A.  Well,  there  were  several  reasons  aside  from  kind  of 
computer  aspects  even  when  the  investigation  was  with  the  office  in 
Iraq.  It  was  pretty  much  understood  that  CCIU  would  conduct  the 
computer  forensics  related  to  the  case,  but  as  the  case  developed  we 
started  to  understand  that  there  was  going  to  be  most  likely  a  lot  of 
commercial  providers  and/or  other  places  within  the  United  States 
that  we  would  have  to  get  evidence  from  such  as  log  files  and  things 
of  that  nature.  Typically  in  a  case  where  we  have  to  deal  with 
commercial  providers  like  say  Google  or  Microsoft  typically  to  compel 
them  to  provide  evidence  to  us,  we  will  get  a  federal  magistrate 
search  warrant,  and  a  federal  magistrate  was  something  that  was  not 
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available  in  Iraq.  They  don't  have  a  federal  magistrate  over  there. 
So  that  was  another  reason  that  the  case  was  transferred  to  us. 

Q.  Now,  does  the  CC  —  Does  the  CCIU  agents  work  with  the 
assistant  U.S.  attorneys  and  federal  magistrates  often? 

A.  Yes,  very  often,  because  - 

ADC [CPT  TOOMAN] :  Objection,  Your  Honor.  Relevance. 

MJ:  Overruled.  Go  ahead. 

A.  Yes  we  work  with  assistant  U.S.  attorneys  and  federal 
magistrates  very  often.  Generally  because  when  a  computer  intrusion 
incident  occurs  a  lot  of  times  it's  not  apparent  what  the  source  of 
that  intrusion  is  and,  therefore  —  it's  not  always  a  Soldier, 
therefore,  we  wouldn't  always  deal  with  a  SJA  or  a  trial  counsel 
initially. 

Q.  Now  were  there  --  Other  than  sort  of  the  need  to  interact 
with  the  commercial  providers  in  order  to  obtain  search 
authorizations,  any  other  reasons  why  the  case  was  better  suited  for 
or  why  the  case  was  transferred  to  CCIU  in  the  United  States? 

A.  We  discussed  the  obviously  computer  aspect  of  it.  The  fact 
that  there  would  be  federal  magistrates  most  likely  involved  to 
compel  the,  you  know,  commercial  providers.  There  was  also,  you 
know,  maybe  not  so  obviously,  but  personnel  within  the  United  States 
that  knew  Manning.  As  well  as  we  also  developed  there  was 
indications  that  there  was  persons  that  he  had  met  with  or  had  been 
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in  contact  with  in  the  Boston  area  during,  well,  before  his  time  in 
Iraq  as  well  as  during  the  time  he  was  on  leave. 

Q.  And  how  did  the  evidence  get  from  Iraq  to  the  United  States 
that  was  initially  collected? 

A.  There  was  —  Initial  evidence  was  collected  in  Iraq  that 
basically  the  agents  there  had  collected  and  that  evidence  was 
brought  from  Iraq  via  one  of  the  these  agents  who  was  going  on  leave 
who  hand  carried  the  evidence  with  him  from  Iraq  to  the  Washington, 
D.C.  area.  I  met  him  in  the  airport. 

Q.  You  met  him  at  the  airport? 

A.  I  did. 

Q.  And  what  was  that  - 

MJ:  What  airport? 

Q.  What  airport  was  that? 

A.  It  was  Dulles  International  Airport. 

Q.  And  when  approximately  was  that? 

A.  I  would  have  to  look  at  the  evidence  documents.  I  mean,  it 
would  probably  sometime  in  the  second  week  of  June.  Right  about 
there  I  believe. 

Q.  And  once  you  met  that  agent  at  Dulles  what  did  you  do  next? 

A.  We  basically  inventoried  the  items  that  he  had  hand  carried 

per  the  evidence  vouchers  that  he  also  had  and  then  I  signed  for  the 
items  and  then  I  hand  carried  them  to  our  evidence  room  at  CCIU. 
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Q.  And  once  the  evidence  was  in  the  United  States  how  did  the 
investigation  progress  from  there? 

A.  Initially  we  looked  at  various  pieces  of  evidence.  The 
forensic  team  of  CCIU  began  examining  the  evidence  that  had  been 
received  as  well  as  evidence  that  had  been  collected  in  other  places. 
And  based  on  the  examination  of  that  evidence,  the  forensic  team 
would  then  alert  us,  the  investigative  team  to  leads  or  investigative 
matters  that  needed  to  be  followed  up. 

Q.  And  at  this  point  when  the  evidence  was  transferred,  was 
the  case  very  well  developed? 

A.  No,  the  case  was  just  developing  essentially. 

Q.  And  what  were  you  —  what  were  the  case  agents  using  to 
sort  of  track  down  leads?  What  was  being  revealed  by  the 
examinations  by  the  forensic  examiners? 

A.  Well,  for  example,  on  some  of  the  digital  media  that  was 
collected  in  Iraq  that  I  believe  there  were  chat  logs  between  PFC 
Manning  and  Mr.  Lamo  that  were  —  or  correspond  to  chat  logs  between 
Mr.  Lamo  and  PFC  Manning  from  digital  media  that  was  collected  from 
Mr.  Lamo.  So  looking  at  those  chat  logs  as  well  as  other  information 
that  was  contained  on  the  digital  media  that  being  examined  such  as 
there  was  email  PFC  Manning  I  believe  it  was  on  his  personal 
computer.  Those  items  of  information  that  were,  you  know,  in  those 
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1  digital  media  items  created  investigative  leads  to  identify  certain 

2  people  to  interview  them. 

3  Q.  And  what  did  the  chat  logs  reveal  regarding  sort  of  the 

4  scope  of  the  alleged  transmissions  or  compromising  information? 

5  ADC [CPT  TOOMAN] :  Objection,  Your  Honor.  This  is  cumulative. 

6  We've  already  gone  over  the  chat  logs. 

7  ATC[CPT  MORROW]:  I'm  asking  a  very  general  question,  Your 

8  Honor,  to  —  for  him  to  provide  context  to  his  testimony. 

9  M J :  Are  you  going  to  go  down  the  same  road  you  went  before? 

10  ATC [CPT  MORROW]:  Absolutely  not. 

11  MJ:  All  right.  Go  ahead.  Overruled. 

12  A.  Can  you  repeat  the  question,  sir? 

13  Q.  What  was  revealed  in  the  chat  logs  that  provided  sort  of 

14  context  to  the  compromise  or  the  alleged  compromises  of  information? 

15  A.  I'm  not  following,  sir. 

16  MJ:  Neither  am  I. 

17  Q.  Who  was  the  recipient  of  information  allegedly  comprised  by 

18  PFC  Manning? 

19  A.  According  to  the  chat  logs  and  other  information  it 

20  appeared  that  the  organization  WikiLeaks  was  the  recipient  of 

21  information. 

22  Q.  And  what  is  WikiLeaks? 
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A.  WikiLeaks,  to  my  knowledge,  is  a  organization  which  its 
mission  is  to  obtain  and  publicly  display  or  publish  documents  from 
governments  and  other  private  organizations. 

Q.  And  when  did  the  WikiLeaks  organization  become  widely 
known? 

A.  It  was  probably  widely  known  following  the  disclosure  of  a 
video  involving  U.S.  Army  helicopter  involved  in  combat  operation. 

Q.  And  what  was  released  during  that  --  what  was  the  release 
essentially  can  you  describe  what  was  released  by  WikiLeaks? 

A.  I  believe  it  was  on  April  5th  of  2010,  WikiLeaks  or  members 
of  WikiLeaks  held  a  press  conference  type  of  event  where  they 
displayed  and/or  published  an  edited  version  of  a  video  taken  from  an 
Army  helicopter  involved  in  a  combat  operations. 

Q.  What  do  you  mean  by  an,  edited  video? 

A.  To  my  knowledge  the  video  was  edited  from  the  original 
video . 

ADC  [CPT  TOOMAN] :  Objection,  Your  Honor.  This  witness  has  no 

personal  knowledge  of  any  editing  that  would  have  been  done  on  the 
video. 

MJ:  Hold  on.  Does  he? 

Q.  Agent  Mander,  are  you  familiar  with  the  video,  the  Apache 
video?  Have  you  seen  the  Apache  video  in  its  full  form  as  part  of 
this  investigation? 
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A.  I  don't  remember  having  seen  the  original  video,  but  I  know 
from  looking  at  the  version  that  was  released  by  WikiLeaks,  that  it 
had  been  edited  because  there  was  certain  information  that  wouldn't 
have  been  contained  in  the  original  such  as  names  of  some  of  the 
personnel  that  were  casualties  in  the  video. 

Q.  And  you  said  the  WikiLeaks  organization,  is  it  a  website 
you  said  it  publishes  information?  What's  the  —  How  does  it  publish 
information? 

A.  The  WikiLeaks  organization  has  a  website.  The  domain  name 
is  WikiLeaks.org,  or  0-R-G,  and  they  also  have  several  other  we  call 
them  mirror  websites  that  contain  generally  the  same  content  as  the 
main  site. 

Q.  What  do  you  mean  by  a,  mirror  website? 

A.  When  I  say  mirror  I  mean  that  there  were  additional 

websites  using  other  domain  names  that  appear  to  have  been  hosted 
physically  in  other  countries  or  other  jurisdictions  I  guess  you 
could  say  that  would  contain  the  same  content  as  the  main  site  and 
presumably  with  the  intent  so  that  if  the  main  site  was  ever  taken 
down  by  some  type  of  government  order  or  - 

ADC  [CPT  T00MAN] :  Objection,  Your  Honor,  this  witness  would 

have  no  knowledge  of  why  it  would  be  on  multiple  sites. 

MJ:  I'm  going  to  sustain  that  unless  there  is  a  foundation. 
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Q.  To  your  knowledge.  Agent  Mander,  is  the  WikiLeaks.ORG 
website  still  active? 

A.  It's  still  active. 

Q.  And  who  can  access  the  website? 

A.  Any  member  of  the  general  public. 

Q.  Who  is  the  public  face  or  leader  of  WikiLeaks? 

A.  There  is  a  Mr.  Julian  Assange  is  kind  of  the  self-described 

leader  or  editor  of  WikiLeaks. 

Q.  Agent  Mander,  I  want  to  talk  about  the  structure  of  the 
investigation  when  it  came  back  to  the  United  States.  Outside  of 
CCIU,  what  other  investigative  organizations  were  involved  in  the 
investigation  of  PFC  Manning? 

A.  Initially  the  Department  of  State  Diplomatic  Security 
Service  or  DSS,  was  involved  in  investigating  the  compromise  and/or 
unlawful  disclosure  of  a,  I  believe  it  was  a  diplomatic  cable  related 
to  information  involving  Iceland,  and  that  had  occurred  several 
months  before  CID  was  involved  in  the  investigation. 

Q.  And  other  than  the  DSS  what  other  organizations  were 
involved? 

A.  Initially  when  we  received  information  from  or  should  I  say 
that  information  was  developed  about  a  Soldier  in  Iraq  possibly 
unlawfully  disclosing  classified  information  Army  military 
intelligence  was  also  involved  because  initially  there  was  a  concern 
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that  possibly  foreign  intelligence  service  could  be  involved  as  well 
as  the  State  Department  and  Army  Military  Intelligence. 

Q.  Any  federal  law  enforcement  authorities? 

A.  Later,  probably  in  June,  late  June  or  maybe  July  the  FBI 
also  became  involved. 

Q.  What  was  the  status  of  the  investigation  or  did  the  various 
investigative  organizations,  were  they  working  together? 

A.  Yes,  they  —  we  consider  it  what  we  call  a  joint 
investigation  and  what  that  means  is  that  the  investigative  agencies 
each  determine  that  they  will  work  together  and  typically  they  will 
define  kind  of  investigative  leads  specific  to  that  agency's  interest 
that  they  will  pursue. 

Q.  And  what  was  CCIU's  lane  essentially? 

A.  CCIU  was  to  investigate  all  Army  and/or  DoD  related 
investigative  leads. 

Q.  And  what  was  the  FBI's  lane? 

A.  The  FBI  they  would  be  investigating  any  civilian  leads  that 
didn't  really  have  like  a  Department  of  Defense  or  Army  nexus. 

Q.  Generally  did  the  investigative  organizations  share 
information? 

A.  Yes. 
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Q.  And  what  about  investigative  activities,  did  the  various 
organizations  stay  in  their  lane  or  did  they  --  did  you  all  do, 
conduct  investigative  activities  together? 

A.  Yes.  There's  numerous  instances  such  as  various  interviews 

that  were  done  jointly.  So,  for  example,  there  was  at  least  one 
interview  that  I  conducted  where  there  was  CID,  Army  Military 
Intelligence  as  well  as  the  DSS  agents  participated  in  the  interview. 

Q.  And  as  part  of  this  investigation  approximately  how  many 
individuals  have  you  interviewed? 

A.  I  would  have  to  go  back  and  look  at  the  case  file,  but  I 
would  say  probably  at  least  25  or  more. 

Q.  And  are  you  familiar  with  agent's  investigative  reports? 

A.  I'm  familiar,  yes. 

Q.  And  approximately  how  many  reports  have  you  filed  as  part 
of  this  investigation? 

A.  Again,  I'd  have  to  review  the  case  file,  but  I  would  say 
probably,  probably  in  excess  of  at  50  least. 

Q.  I  want  to  talk  about  some  other  investigative  activity  that 
CCIU  conducted  in  relation  to  this  case.  As  part  of  the 
investigation,  did  CCIU  preserve  or  collect  information  on  the  — 
that  was  posted  on  the  WikiLeaks  website? 

A.  At  various  points  I  believe  there  was  agents  that  were 
assigned  to  download  information  that  was  published  on  the  WikiLeaks 
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website  because  it  contained  classified  information  and  was  otherwise 
evidence . 

Q.  And  what  would  be  the  benefit  of  collecting  information 
from  there?  How  would  that  —  How  was  that  information  used? 

A.  The  information  that  was  collected  from  the  WikiLeaks 
website  would  be  used  for  comparison  purposes  to  information  that  may 
be  found  on  digital  media  that  was  collected  in  the  case  from  various 
places,  from  various  sources. 

Q.  Now,  is  that  a  typical  - 

MJ:  Yes. 

ADC  [CPT  TOOMAN] :  We  will  object  to  this  line  of  questioning 

the  witness  said  that  other  agents  are  the  ones  that  downloaded.  So 
the  witness  has  no  personal  knowledge. 

ATC [CPT  MORROW]:  Your  Honor,  I  think  I've  established  he  has 

personal  knowledge  of  the  entire  investigation. 

MJ:  Overruled. 

Q.  Is  that  a  typical  investigative  activity  for  CCIU? 

A.  What? 

Q.  Collecting  —  Preserving  and  collecting  information  from 
websites . 

A.  In  some  cases,  yes. 

Q.  Now,  based  on  your  knowledge  and  experience,  are  there  ways 
to  observe  a  website  as  it  appeared  on  a  certain  date? 
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A.  There  are  certain  tools  that  would  allow  you  to  see  what  a 
website  looked  like  previously. 

Q.  And  what  are  some  of  those  tools? 

A.  One  tool  that  we  will  occasionally  use,  it's  a  website  that 
uses  the  domain  name  archive.org  and  it  also  has  a  nickname.  They 
call  it  the  wayback  machine. 

Q.  And  are  there  any  other  ways  that  you  might  observe  a 
website  as  it  appeared  at  a  certain  date  prior? 

A.  I  know  that  Google  is  also  a  potential  source.  Google  as 
it  looks  at  websites  to  catalog  them  for  search  results  that 
sometimes  saves  a,  what  we  call,  a  cached  version  of  that  website. 

Q.  Can  you  explain  how  an  agent  or  how  would  you  use  Google 
cache  to  see  how  a  website  might  have  appeared  on  a  certain  day? 

A.  Well,  for  example,  somewhat  recently  I  was  searching  for 
particular  terms  to  see  if  I  could  find  something  and  sometimes 
especially  DoD  computer  networks  we  may  be  blocked  from  going  to 
certain  websites  because  of  either  the  nature  of  the  website  or 
sometimes  make  a  key  word  such  as  something  involving  something 
sexual  will  be  automatically  blocked  through,  you  know,  Internet 
filtering.  So  to  get  around  this  issue  sometimes  you  can  look  at  the 
Google  cached  version  and  get  an  idea  of  what  the  website  that  you're 
looking  for  looks  like. 
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Q.  How  would  you  access  the  Google  cache  version  versus  the 
website  that's  being  blocked?  How  does  it  appear  to  you  on  the 
screen  when  you  are  accessing  the  Google  cached  version? 

A.  Generally  speaking  you  would  put  your  search  terms  into  the 
Google  website  would  you  hit  search  and  you  would  then  receive 
results,  and  then  typically  there  is  —  it  depends  on  what  time  or 
era  we're  talking  about,  but  right  now  presently  there's  like  a 
little  arrow  next  to  the  one  of  search  results  and  then  you  can 
choose  to  see  the  cache  version  versus  the  actual  version. 

Q.  And  the  cache  version,  does  it  indicate  that  date  that  the 
website  was  saved  or  downloaded  or? 

A.  Typically  when  you  view  the  cached  version  at  the  top 
portion  of  the  version  that  you'll  see  it  will  say  something  to  the 
effect  of,  this  is  Google's  version  of  this  website  on  whatever  date 
and  time,  and  it  also  will  give  you  a  caveat  that  the  website  may 
have  changed  since  then. 

Q.  And  you  mentioned  the  Internet  archive  or  archive.org.  Can 
you  explain  how  you  might  use  that  tool  to  observe  a  website  in  the 
past? 

A.  That  tool  is  little  more  comprehensive  and  it's  - 

Q.  First  let's  —  Well,  let's  start  with  this  then.  What  is 
the  Internet  archive  or  what  is  archive.org? 
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A.  Archive.org  is  a  website  that  was  established.  It  seems  to 
be  funded  by  some  type  of  nonprofit  organization  that  their  goal  is 
to  catalog  websites  on  the  Internet,  amongst  other  things.  So  what 
their  website  does  is  it  appears  to  periodically  go  out  and  download 
the  content  of  websites  and  then  it  saves  them  for  retrieval  by  the 
general  public  that  want  to  use  or  see  what  a  particular  site  looked 
like  in  the  past. 

Q.  Now,  in  your  experience  as  an  agent,  have  you  used  the 
Internet  archive  or  archive.org  to  see  how  a  website  might  have 
looked  in  the  past? 

A.  Yes.  There's  been  occasions  where  a  website  involved  on  an 
investigation  may  have  been  taken  down  at  the  time  that  we  want  to 
look  at  it  and  thereafter  we  would  like  to  see  when  it  previously 
looked  like  and,  therefore,  we  might  use  that  tool  as  a  way  to  see 
what  a  website  looked  like  in  the  past. 

Q.  Okay.  So  take  me  through  how  you  might  use  the  Internet 
archive  or  archive.org.  Just  describe  from  the  beginning  and  we'll 
try  to  go  through  is  this  slowly. 

A.  Okay.  Assuming  that  you  have  a  web  browser  and  computer 
connected  to  the  Internet,  you  would  open  up  the  web  browser  window, 
you  would  navigate  to  the  archive.org  website.  On  that  website  there 
is  a  place  we  can  enter  in  text  of  what  you  want  to  see.  So  you 
would  presumably  put  in  the  address  or  uniform  resource  locator  code 
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for  the  websites  that  you're  interested  in.  You  would  then  hit  a 
search  button  at  which  point  if  the  website  has  been  archived  or 
catalogued  within  archive.org  you  would  be  shown  something  that 
resembles  like  a  calendar  and  that  calendar  will  have  little  circles 


for  days 

that  a  capture  of  the  website  that  you've  typed  in  has  been 

archived 

at  which  point  you  can  then  click  on  the  little  circles  and 

see  that 

version  of  that  website  that  has  been  archived. 

Q. 

And  it's  —  That  version  of  that  website  it's  linked  to  a 

date? 


A. 

Yes.  There  will  be  like  a  date  and  time  sometimes  some 

websites 

are  catalogued  archived  more  than  once  per  day. 

Q. 

Now,  once  you've  clicked  on  that  date,  what  happens? 

A. 

Typically  the  website  for  the  day  and/or  time  that  you've 

clicked  on  will  then  display  and  you  will  see,  generally  speaking, 
what  that  website  looked  like  on  that  day  and  time. 


Q. 

Now,  if  you  printed  that  web  page  from  the  Internet 

archive, 

what  would  happen? 

A. 

If  you  printed  that  page  you  would  get  a  printout  of 

generally  what  was  on  the  screen,  and  depending  on  the  browser 
settings  the,  most  browsers  have  the  ability  to,  you  can  include  the 
thing  you've  printed,  the  address  of  the  website  as  well  as  the  date 
and  time  and  maybe,  say,  like  the  number  of  pages  and/or  the  title  of 
the  website. 
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ATC [CPT  MORROW]:  I'm  retrieving  what's  been  marked  as 

Prosecution  Exhibit  109  for  Identification. 

MJ:  Proceed. 

ATC [CPT  MORROW]:  I'm  handing  the  witness  - 

ADC [CPT  TOOMAN] :  Your  Honor,  the  defense  requests  the 

opportunity  to  voir  dire  this  witness  about  his  knowledge  of  the 
Wayback  machine  or  archive.org,  and  how  it  functions. 

MJ:  With  the  goal  of  preventing  admissibility  of  this  exhibit? 

CDC [MR .  COOMBS]:  Yes,  Your  Honor,  voir  dire  and  aid  of  the 

objection.  So,  we  would  object  to  foundation,  personal  knowledge  of 
this  witness  and  we'd  like  to  voir  dire  in  aid  of  that  objection. 

MJ:  Let  me  see  the  exhibit.  Why  don't  we  do  this,  again  I  have 
two  roles  here.  One  of  them  is  as  the  military  judge  as  I  would  be 
in  every  case  for  motions  to  decide  the  legality  or  non-legality  of 
something  whether  it's  coming  in.  In  that  role,  I  will  allow  the 
government  at  least,  at  this  point,  to  go  forward  with  the  questions 
on  what  their  foundation  would  be  with  respect  to  admitting  this 
exhibit  and  then  I'll  allow  the  defense  a  chance  to  voir  dire  the 
witness  and  decide  your  objections.  Should  I  rule  in  favor  of  the 
defense  and  not  of  this  exhibit,  I  won't  consider  it.  Fair  to  both 
sides? 

CDC [MR.  COOMBS:  Yes,  Your  Honor. 

ATC [CPT  MORROW]:  Yes,  Your  Honor. 
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MJ:  Proceed.  Let  me  see  what  that  exhibit  is  first. 

Questions  continued  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  I'm  handing  the  witness  what's  been  marked  as  Prosecution 
Exhibit  109  for  Identification.  Do  you  recognize  that  document, 

Agent  Mander? 

A.  I  do. 

Q.  And  what  is  it? 

A.  In  appears  to  be  a  version  of  the  most  wanted  leaks  of  2009 
list  that  was  obtained  from  the  archive.org  website. 

ATC [CPT  MORROW]:  Permission  to  publish  to  the  Court,  Your  Honor. 
MJ:  Proceed. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
the  exhibit  to  the  Court.] 

Q.  Agent  Mander,  I  want  to  focus  mainly  on  sort  of  the  bottom 
of  the  —  of  this  page,  specifically  the  line  at  the  very  bottom  that 
starts  with  HTTP://.  Do  you  see  that? 

A.  Yes,  I  can  see  it. 

Q.  Can  you  explain  just  by  looking  at  that  line  what  this  web 
image  or  what  this  printout  shows  or  what  exactly  that  means  down  at 
the  bottom? 

A.  As  I  mentioned,  when  you  print  a  document  using  your  web 
browser  various  web  browsers  will  allow  you  to  include  in  the  header 
or  footer  of  what  you're  printing  information  such  as  the  URL  of  the 
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document  you're  printing.  So,  for  example,  based  on  this  footer 
here,  this  would  be  a  document  that  was  printed  from  the  address 
that's  listed  there  that  starts  with  the  HTTP: //web. archive.org. 

Q.  And  what  are  the  numbers,  it  says  /  and  then  a  web  again. 
What  are  the  numbers  to  the  right  of  the  —  starting  with  2009?  What 
does  that  indicate? 

A.  As  far  as  my  knowledge,  that  would  be  the  date  and  most 
likely  the  time  of  the  capture  of  the  website  which  follows  after  the 
numbers  the  HTTP: //WikiLeaks . org. 

Q.  And,  again,  what  does  it  say  at  the  end  after 
WikiLeaks . org? 

A.  /wiki/draft : the_most  and  then  it  looks  like  the  whole  URL 
is  too  long  for  the  footer  so  it's  the  dots  kind  of  indicate  there's 
more . 

Q.  Now,  as  part  of  this  case,  Agent  Mander,  have  you  had  the 
opportunity  to  see  whether  the  website  still  exists  even  outside  of 
using  the  archive.org? 

A.  The  WikiLeaks  website? 

Q.  The  WikiLeaks  website,  and  specifically  the  2009  draft. 

The  website  you  just  looked. 

ADC [CPT  TOOMAN] :  Objection.  Relevance  of  what  WikiLeaks.org 

looked  like  today.  Not  relevant.  Your  Honor. 

MJ:  Where  are  you  going  with  this? 
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ATC [CPT  MORROW] :  Your  Honor,  between  how  it  looked  in  the 

past  and  how  the  website  still  appears  today,  it  can  still  —  you  can 
still  find  it  on  the  web  today. 

MJ:  You're  asking  this  witness  if  this  witness  can  find  that 

document  today? 

ATC [CPT  MORROW]:  Yes,  exactly. 

MJ:  Okay.  That's  overruled. 

Q.  Agent  Mander,  please,  explain  how  you  would  find  this 
document  or  this  web  page  today? 

A.  That  particular  document  I  believe  I  had  used  some  key 
words  and  conducted  a  search  using  Google,  and  one  of  the  first  or 
maybe  one  of  the  first  full  results  was  that  document  that  is 
actually  or  was  on  the  WikiLeaks  website  as  of  just  a  couple  of  weeks 
ago. 

ATC [CPT  MORROW]:  I'm  retrieving  what's  been  marked 

Prosecution  Exhibit  110  for  Identification. 

MJ:  Are  you  going  to  have  similar  objections  to  this  one? 

ADC  [CPT  TOOMAN] :  May  I  see  it.  Your  Honor?  Can  I  have  a 

moment.  Your  Honor? 

MJ:  Yes. 

[There  was  a  brief  pause  while  the  assistant  defense  counsel 
retrieved  and  reviewed  the  exhibit  at  counsel  table . ] 

ADC  [CPT  TOOMAN] :  Not  at  this  time.  Your  Honor. 
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1  MJ:  All  right. 

2  Questions  continued  by  the  assistant  trial  counsel  [CPT  MORROW] : 

3  Q.  Agent  Mander,  I'm  handing  you  what's  been  marked  as 

4  Prosecution  Exhibit  110  for  Identification.  Can  you  take  a  look, 

5  please? 

6  A.  [Reviewing  the  exhibit.] 

7  Q.  Do  you  recognize  that  document? 

8  A.  Yes  this  is  a  document  similar  to  the  one  that  you  just 

9  showed  me.  It  is  the  version  that  you  would  find  on  the 

10  WikiLeaks.org  website  as  of  June  1st. 

11  Q.  And  how  do  you  know  that? 

12  A.  I  went  to  the  site  and  printed  out  this  document  and  I  have 

13  initialed  the  bottom  above  the  date  and  time  on  each  page. 

14  Q.  And  what  did  you  do  —  So,  how  was  that  document  created? 

15  You  printed  it? 

16  A.  I  printed  it,  yes. 

17  ATC [CPT  MORROW]:  Permission  to  publish  to  the  Court,  Your 

18  Honor. 

19  MJ:  Proceed. 

20  [There  was  a  brief  pause  while  the  assistant  trial  counsel  published 

21  the  exhibit  to  the  Court . ] 

22  Q.  Agent  Mander,  how  is  this  web  page  —  how  is  this  web  page 

23  organized? 
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A.  Well  generally  speaking,  it  looks  like  it's  - 

Q.  Do  you  need  the  exhibit  back? 

A.  Sure.  At  the  top  of  the  document  it  says  the  word 
draft : themostwantedleaksof2009-sort,  and  generally  speaking  below 
that  there  is  somewhat  of  like  a  table  of  contents  which  are  links, 
and  each  of  the  links  represents  the  various  countries  in 
alphabetical  order  to  include  like  a  miscellaneous  category  of 
international  organizations.  And  then  below  that  are  listed  various 
countries  and  below  each  country  appears  to  be  a  list  of  documents  or 
other  information. 

Q.  Does  the  United  States  appear  on  that  list? 

A.  The  United  States  does  appear  on  this  list. 

Q.  And  what  page  is  that? 

A  It  begins  on  Page  9  and  appears  to  go  to  Page  11. 

ATC [CPT  MORROW]:  Your  Honor,  permission  to  publish  Page  9  to 

the  Court. 

MJ:  Proceed. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
the  exhibit  to  the  Court . ] 

Questions  continued  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  Agent  Mander,  at  this  time.  I’d  like  you  to  move  to  the 
panel  box,  please,  if  you  would? 

A.  What's  the  panel  box? 
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Q.  Right  here.  You  can  just  leave  the  exhibit  back.  Thank 

you. 

ATC [CPT  MORROW]:  I'm  handing  Agent  Mander  what's  been 

admitted  as  Prosecution  81. 

Q.  Mr.  Mander,  Agent  Mander,  I'd  like  you  to  scroll  down  to  28 
November  in  that  exhibit. 

A.  Okay. 

Q.  And  I'd  like  you  to  look  at  lines  27  through  33. 

A.  Okay. 

Q.  What  are  lines  27  to  23  —  or  33,  what  do  they  say? 

A.  The  whole  line  or  just  the  action  column? 

Q.  The  action  line,  please. 

A.  From  line  27  the  action  column  reads, 

'  ret ention+of tint errogation+videos' . 

Q.  On  this  list  found  on  this  website,  do  you  see  any  similar 
information? 

A.  Can  you  move  up  to  the  top  of  the  document? 

Q.  Let  me  help  you.  Do  you  see  anything  under  Military 
Intelligence? 

A.  On  the  second  bullet  there's  a  Cl  detainee  interrogation 
videos.  That  appears  there. 

Q.  And,  again,  like  for  you  to  scroll  to,  in  that  exhibit  that 
you  are  looking  at.  Scroll  to  lines  114  and  115,  please. 
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A.  Okay. 

Q.  What  do  you  see?  What's  the  action  there?  What's  the 
information? 

A.  Line  114  it  reads,  'interrogation+tapes'  and  line  115  it 
reads,  'interrogation+video' . 

Q.  Agent  Mander,  now,  I'd  like  to  go  back  to  29  November, 
please  and  lines  43  and  44  specifically. 

A.  Okay. 

Q.  And  have  you  found  that? 

A.  I  have. 

Q.  And  what  are  the  lines  —  what  do  those  read? 

A.  The  action  column  it  reads,  'detainee+abuse'  and  that's  for 
line  43,  line  44  is  the  same,  'detainee+abuse' . 

Q.  And  does  similar  information  exist  under  the  Military 
Intelligence  section  of  this  web  page? 

A.  On  the  fourth  bullet  the  words,  'detainee  abuse  photos 
withheld  by  the  Obama  administration' . 

Q.  Now,  I'd  like  to  go  to  30  November  in  line  62. 

A.  Okay. 

Q.  And  what  does  that  line  read? 

A.  The  action  column  also  reads,  'detainee+abuse'  . 
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Q.  Now,  I  want  you  to  go  to  a  serious  of  searches  starting  on 
8  December.  I'm  looking  specifically  at  —  if  you  could  refer  to 
lines  100  through  111. 

A.  Line  100,  the  action  column  reads, 

'Guantanamo+detainee+oper at ions' . 

Q.  Okay.  Just  keep  reading.  Just  read  all  of  them  down  to 

111. 

A.  The  next  line,  ' JTF+G-T-M-0'  GTMO .  The  next  line  is, 

' JTF+GTMO' ,  excuse  me  'G-T-M-O+SOP' .  Next  line  is  C-J-T- 
F+82+detainee+  SOP' .  Next  line  is  'C-J-A-T-F- 
+82+detainee++operations' .  Next  line  is,  ' J-T-F+G-T-M- 
O+SOP+interrogation' .  Next  line  is,  'C-G' ,  excuse  me,  'C- J-T-F+101' . 
The  next  line  is,  ' J-T-F+G-T-M-O+SOP+interrogation' .  The  next  line 
is,  'SOP+interrogation' .  The  next  line  is,  ' J-T-F+G-T-M-O' .  The 
next  line  is,  ' J-T-F+G-T-M-O+SOP' .  The  next  line  is,  ' J-T-F+G-T-M- 
O+Delta+SOP' .  The  next  line  is,  'human+rights+campaign' . 

Q.  Okay.  First  what's  SOP  mean  to  you  as  somebody  who's  been 
in  the  military? 

A.  Generally  that's  an  abbreviation  for  an  acronym  for 
standard  operating  procedure. 

Q.  And  what  does  Delta  mean  to  you  in  the  context  of  these 


searches? 


o 
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1  A.  I  would  assume  that  would  be  Camp  Delta,  which  is  a  portion 

2  of  Guantanamo  Bay  and  the  detainee  facility  there. 

3  Q.  Now,  those  lines  100  through  111,  is  any  similar 

4  information  or  items  appear  in  this  list  here?  I'll  give  you  a 

5  moment.  I  would  ask  you  just  to  review  all  the  way  down.  When  you 

6  see  something  that  catches  your  eye,  please,  let  me  know. 

7  A.  [Reviewing  the  document.]  On  the,  I  believe  it's  the 

8  seventh  bullet  use  the  word  Camp  Delta  (Guantanamo)  standard 

9  operating  procedures,  excuse  me  procedure  2005/2009.  Two  bullets 

10  below  that  is  the  words,  'unredacted  inguiry  into  treatment  of 

11  detainees  in  U.S.  custody  20  November  2008'.  A  few  bullets  below 

12  that  is  the  words  Camp  Delta  (Guantanamo  standard  operating  procedure 

13  2005-2009' ,  below  that  is  Camp  Delta  (Guantanamo  interrogation 

14  standard  operating  procedure  2003-2009,  and  that  appears  to  be  all 

15  what  I  see. 

16  ATC [CPT  MORROW]:  Your  Honor,  at  this  time  the  prosecution 

17  moves  to  admit  Prosecution  Exhibits  109  and  110  into  evidence  as 

18  Prosecution  Exhibit  109  and  110. 

19  MJ:  All  right.  Well,  I'm  going  to  allow  the  defense  to  voir 

20  dire  witness  before  - 

21  ATC [CPT  MORROW]:  Sure,  of  course. 

22  MJ:  -  we  do  that.  Are  you  finished? 
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ATC  [CPT  MORROW]:  No,  no,  I'm  not,  actually.  I'm  sorry.  I 

have  a  few  more  questions  to  go  through  regarding  different  exhibits 
but  I  can  stop  now,  if  you  like. 

MJ:  Why  don't  we  stop  now?  I'll  let  the  defense  voir  dire  and 

we'll  concentrate  on  those  exhibits.  We'll  go  a  little  bit  out  of 
order  and  then  we'll  call  —  we'll  resolve  that  issue  and  then  we'll 
go  forward  with  the  rest  of  your  direct. 

ATC [CPT  MORROW]:  I'm  replacing  Page  9  in  Prosecution  Exhibit 

for  ID  110. 

MJ:  Now,  does  the  witness  need  to  remain  there  or  can  the 

witness  come  back  to  the  chair? 

ATC [CPT  MORROW]:  The  witness  can  go  back  to  the  chair.  Your 

Honor. 

MJ:  All  right. 

[The  witness  resumed  his  seat  at  the  witness  stand.] 

ADC  [CPT  TOOMAN] :  We  would  object  to  Prosecution  Exhibit  110  as 
hearsay. 

TC [MAJ  FEIN]:  Ma'am,  the  United  States  is  retrieving 
Prosecution  Exhibit  81  from  the  witness. 

MJ:  Okay. 

ATC [CPT  MORROW]:  I'm  handing  the  court  reporter  Prosecution 

Exhibit  110  for  ID. 
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1  VOIR  DIRE  EXAMINATION 

2  Questions  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

3  Q.  Agent  Mander,  I  want  to  talk  to  you  a  little  bit  about 

4  archive.org,  Wayback  machine.  Prosecution  Exhibit  109  for 

5  Identification.  You  didn't  actually  visit  WikiLeaks.org  in  2009,  did 

6  you? 

7  A.  No,  not  in  2009. 

8  Q.  So  you  didn't  actually  see  what  their  website  looked  like 
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in  2009? 

A.  In  2009  I  did  not  actually  go  to  the  website  and  see  it. 

Q.  And  with  archive.org  what  you  see  is  what  they  tell  you  was 

there,  you  didn't  actually  see  what  was  there  in  2009? 

A.  If  I  go  to  archive.org  I  see  what  is  presented  for  the  date 
that  they  say  that  it  was  there. 

Q.  Okay.  You  don't  have  any  knowledge  of  how  archive.org 
actually  compiles  their  data,  do  you? 

A.  I  do  not.  I  have  various,  I  guess,  you  can  say, 
assumptions  of  how  it  works  based  on  my  knowledge  in  the  field. 

Q.  But  you  don't  know  where  that  data  comes  from? 

A.  Which  data? 

Q.  The  data  that's  on  archive.org. 

A.  I  would  assume  that  it  comes  from  the  sites  that  are 


23 


presented  that  they  archive. 
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1  Q.  So  you  don't  know  where  it  comes  from?  You  don't  know  how 

2  the  data  is  gathered? 

3  A.  Technically,  no,  I  don't  know  how  that  data  is  gathered. 

4  Q.  You  don't  know  how  often  that  data  is  gathered?  You  don't 

5  know  the  frequency  of  that  data  gathering? 

6  A.  I  can  say  that  the  frequency  appears  to  be  just  periodic. 

7  It  doesn't  seem  to  have  a  set  schedule  just  based  on  the  results  that 

8  are  available. 

9  Q.  And  you  don't  know  if  that's  all  of  the  data  because  you 

10  didn't  actually  go  to  the  website  in  2009,  correct? 

11  A.  The  website? 

12  Q.  So  in  this  case  we're  talking  about  the  WikiLeaks  most 

13  wanted  list.  You  didn't  actually  go  to  it  in  2009,  so  when  you  are 

14  looking  at  it  on  archive.org,  you  don't  know  if  anything  is  missing. 


15 

correct? 

16 

A. 

That  would  be  a  fair 

statement . 

17 

Q. 

Now,  you  mentioned  on 

direct  that  when 

you 

go  to 

18 

archive . 

org  there  are  some  days 

that  are  missing. 

,  Do 

you 

know  why 

19 

that  is? 

20 

A. 

I  don't  believe  that 

I  said  that  there 

were 

some 

days  that 

21 

were  missing. 

22  Q.  I  think  you  said  that  the  calendar  would  come  up  and  you 

23  can  click  on  a  day  and  then  if  you  had  the  ability  to  click  on  the 


8085 


o 


J 


day  that  means  that  archive.org  is  saying  that  we  have  a  website  for 
that  day,  but  I  would  imagine  you  can't  click  on  every  day,  can  you? 


3 

A. 

4 

Q. 

5 

A. 

6 

to  have 

7 

Q. 

8 

website 

9 

archive 

10 

A. 

11 

put  on  1 

12 

are  supj 

13 

certain 

14 

or  save 

15 

Q. 

16 

A. 

17 

Q. 

18 

A. 

19 

Q. 

I  believe  there  is  a  file  that  web  host  or  web  masters  can 


20  A.  Based  on  the  results  that  are  displayed  on  their  website 

21  for  various  given  sites  it  appears  to  be  just  periodic.  There 

22  doesn't  appear  to  be  any  particular  time  of  day,  day,  day  of  week,  or 

23  any  other  pattern  that  I  can  discern. 
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l  Q. 

Are  you  aware  of  whether  or  not  are  there  have  ever  been 

2  any  hack 

attempts  on  the  cache  servers  employed  by  archive.org? 

3  A. 

I  do  not  have  any  direct  knowledge,  but  I  would  be 

4  surprised  if  there  were  not  any  hacks. 

5  Q.  Do  you  have  any  knowledge  of  the  operating  system  that  the 

6  servers  are  running? 


7  A. 

I  do  not  have  knowledge  of  what  operating  systems  they're 

8  running 


9  Q. 

Do  you  have  any  knowledge  as  to  whether  or  not  there  are 

10  backups  of  servers? 


11  A. 

I  do  not  have  any  direct  knowledge  of  that. 

12  Q. 

Were  you  actually  there  when  the  particular  website  you 

13  were  talking  about  today,  were  you  there  when  it  was  cached  by 

14  archive.org? 


15  A. 

Was  I  --  when  you  say  there? 

16  Q. 

Were  you  actually  there  when  whoever  from  archive.org 

17  gathered 

what  they  say  was  this  website,  were  you  actually  there  when 

18  they  did 

it? 

19  A. 

I  was  not  at  archive.org  wherever  their  location  is  when 

20  that  was 

archived. 

21  Q. 

You  talked  a  little  bit  about  a  robot. text  file  that  a  site 

22  could  put  on  —  that  a  company  could  or  a  person  could  put  on  their 
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website.  Do  you  have  any  knowledge  of  whether  or  not  WikiLeaks  had 
one  of  those  on  their  website? 

A.  I  do  not  have  any  knowledge  of  that. 

ADC  [CPT  TOOMAN] :  One  moment.  Your  Honor,  please.  Your  Honor, 

we  have  no  further  voir  dire  questions  of  this  witness.  We  would 
objection  to  Prosecution  Exhibit  109  for  Identification  because  this 
witness  has  no  personal  knowledge  of  how  archive.org  operates.  There 
are  a  number  of  cases  that  have  considered  the  admissibility  of 
archive.org. 

MJ:  And  you  plan  to  present  those  to  me  when? 

ADC  [CPT  TOOMAN]:  Right  now.  Your  Honor. 

MJ:  Thank  you. 

ADC  [CPT  TOOMAN] :  I  will  note  first  that  none  of  those  cases 

are  criminal  cases,  they  all  are  civil  cases  dealing  with  either 
trademark  or  paten  law.  One  of  them  is  Telawizj a ,  and  Pardon  my 
pronunciation . 

MJ:  Why  don't  we  do  this:  You  can  read  them  on  the  record,  but 
if  you're  going  to  present  me  cases,  I  am  going  to  have  a  Xerox  copy 
of  them,  right? 

ADC  [CPT  TOOMAN]:  Yes,  ma'am. 

MJ:  Okay. 
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1  ADC[CPT  TOOMAN]:  One  of  them  is,  this  is  a  Polish 

2  pronunciation  so  I  will  butcher  it,  Telawizja  Polska  v.  EchoStar, 

3  would  you  like  the  cite.  Your  Honor? 

4  MJ:  Yes,  please. 

5  ADC  [CPT  TOOMAN]:  It's  2004,  Westlaw  WL2367740.  In  that  case 

6  the  Court  required  an  affidavit  from  the  wayback  machine  from  the 

7  proprietors  of  the  wayback  machine  before  they  would  allow 

8  admissibility  and  also  St.  Luke's  Cataract  cite  2006,  Westlaw  130242. 

9  In  that  case  the  Court  precluded  the  admissibility  of  the  wayback 

10  machine  absent  testimony  from  someone  with  personal  knowledge.  And 

11  so,  in  that  case  the  Court  wanted  actually  someone  from  WikiLeaks. 

12  In  this  case  they  would  want  someone  from  WikiLeaks  to  come  and  talk 

13  about  what  was  actually  on  their  website  at  the  time.  So  our 

14  objection  to  Prosecution  Exhibit  109  for  Identification  would  be 

15  authentication  as  well  as  double  hearsay,  and  we  will,  of  course,  get 

16  you  those  cases.  Your  Honor. 

17  MJ:  Thank  you,  and  your  objection  to  Prosecution  Exhibit  110  is 

18  hearsay? 

19  ADC  [CPT  TOOMAN]:  Yes,  ma'am. 

20  MJ:  Okay.  Government,  do  you  have  any  case  authority  for  me? 

21  ATC [CPT  MORROW]:  The  government  believes  there  are  some  more 

22  recent  cases.  Your  Honor,  that  would  shed  light  on  the  issue  with 

23  respect  to  the  double  hearsay  issue.  I  don't  think  it's  a  double 
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1  hearsay  issue.  Agent  Mander's  testimony  was  very  clear  that  is  a 

2  battle  site  printout  that  was  a  representation  of  the  archive.org 

3  website  capturing  another  website. 

4  MJ:  So  are  you  offering  it  for  the  truth  of  the  matter  asserted 

5  or  not? 

6  ATC [CPT  MORROW]:  No,  Your  Honor.  We're  offering  both 

7  exhibits  for  its  impact  on  the  listener. 

8  MJ:  Okay.  The  hearsay  objection  to  Prosecution  Exhibit  110,  is 

9  overruled.  So  if  there  is  not  any  other  objections  to  Prosecution 

10  Exhibit  110  I'll  admit  that. 

11  ADC  [CPT  T00MAN] :  Your  Honor,  we  would  also  object  based  on 

12  relevance.  There  is  absolutely  no  evidence  that  PFC  Manning  actually 

13  ever  saw  this  particular  website.  So  absent  that  the  defense 

14  believes  it  is  not  relevant. 

15  MJ:  What's  the  relevance? 

16  ATC [CPT  MORROW]:  Your  Honor,  I  believe  Agent  Mander  used 

17  Prosecution  Exhibit  81  to  go  through  and  provide  circumstantial 

18  evidence  through  his  testimony  of  the  user  of  those  computers 

19  searching  for  information  very  similar  to  information  of  the  similar 

20  site. 

21  MJ:  What's  the  difference  between  Prosecution  Exhibit  for 

22  Identification  109  and  110? 
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1  ADC[CPT  TOOMAN] :  There's  no  difference.  Your  Honor.  In 

2  fact,  we  would,  we  can  leave  the  issue  alone.  If  the  —  Prosecution 

3  Exhibit  110  is  admitted. 

4  MJ:  Wait  a  minute,  let's  go  back.  Prosecution  Exhibit  1  —  And 

5  I  know  you  have  to  go.  Just  remind  myself  of  the  witness,  maybe  I 

6  can  ask  him  some  questions  right  now. 

7  ADC [CPT  TOOMAN]:  Yes. 

8  MJ:  Prosecution  Exhibit  110,  what  is  it  and  what  did  you  do  to 

9  get  it? 

10  WIT:  Can  I  see  the  two  exhibits?  To  answer  your  question, 

11  ma'am,  I  believe  the  one  exhibit  is  directly  from  the  WikiLeaks 

12  website  which  was  recently  within  the  last  couple  of  weeks  and  the 

13  other  version  is  the  archive.org  version  of  the  same  document  as 

14  captured,  reportedly  captured  in,  well,  reportedly  captured  in  2009 

15  by  the  archive.org  website. 

16  MJ:  So,  with  Prosecution  Exhibit  110,  was  your  testimony  that 

17  you  basically  Googled  the  WikiLeaks  website  and  there  that  document 

18  was  and  you  printed  it. 

19  WIT:  How  can  I  tell  which  one's  - 

20  ATC[CPT  MORROW]:  The  numbers  are  on  the  bottom  -  Agent 

21  Mander,  if  you  refer  to  the  one  you  printed  yourself  - 

22  WIT:  And  initialed? 

23  ATC [CPT  MORROW] :  Yes. 
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WIT:  I'm  sorry,  ma'am. 

MJ:  That's  okay.  So  the  one  he  printed  himself  is  Prosecution 

Exhibit  110,  right? 

ATC [CPT  MORROW]:  Yes,  ma’am. 

MJ:  So,  tell  me  how  you  got  Prosecution  Exhibit  110,  what  did 

you  do? 

WIT:  I  went  directly  to  the  WikiLeaks.org  website  and  printed 
out  the  document  that  I  had  on  my  screen. 

ADC [CPT  TOOMAN] :  Your  Honor,  just  with  respect  to 

Prosecution  Exhibit  110  for  Identification,  we  would  renew  the 
relevance  objection  based  on  the  fact  that  this  was,  I  think,  the 
date  on  that  it’s  1  June. 

MJ:  Again,  I’m  going  to  overrule  that.  That’s  the  date  of  1 

June,  the  document  itself  has  a  different  date  in  it  that  is  in  the 
document  that’s  on  the  website.  So  what  you're  arguing  is  going  to 
weight,  not  admissibility. 

ADC  [CPT  TOOMAN] :  Okay.  Your  Honor,  we  just  think  that  the 

date  of  2009,  there’s  no  proof  or  no  evidence  that  that  was  actually 
up  on  the  website  in  2009  nor  is  there  evidence  that  PFC  Manning 
actually  saw  in  it  in  2009. 

MJ:  I  understand  all  of  that. 

ADC [CPT  TOOMAN]:  Thank  you.  Your  Honor. 
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MJ:  Now,  with  respect  to  Prosecution  Exhibit  109,  I  will  take 

that  under  advisement.  I  will  consider  the  authority  offered  by  both 
sides  and  make  a  ruling  probably  tomorrow  morning. 

ADC [CPT  TOOMAN] :  Yes,  ma'am. 

ATC [CPT  MORROW]:  Yes,  Your  Honor. 

MJ:  And  do  you  have  cases  to  give  me  as  well? 

ATC [CPT  MORROW]:  We  have  several  cases  that  we  have  —  yes, 

we  do . 

M J :  In  hard  copy? 

ATC [CPT  MORROW]:  Yes,  Your  Honor. 

MJ:  All  right.  Depending  on  how  voluminous  this  authority  is, 

my  ruling  may  not  come  tomorrow  morning,  but  it  will  be  coming. 

ATC [CPT  MORROW]:  I'm  retrieving  Prosecution  Exhibit  110  and 

Prosecution  Exhibit  109  for  Identification  from  the  witness. 

MJ:  Can  I  see  Prosecution  Exhibit  110? 

ATC [CPT  MORROW]:  Yes,  ma'am. 

MJ:  Prosecution  Exhibit  110  is  admitted. 

DIRECT  EXAMINATION  (continued) 

Questions  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  Agent  Mander,  are  you  familiar  with  the  term,  social  media? 

A.  Yes,  I  am. 

Q.  And  what  is  social  media? 


8093 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 


o 


o 


A.  Generally  the  term,  social  media,  refers  to  either  websites 
and/or  systems  that  encourage  members  of  the  general  public  to  create 
accounts  and  then  encourages  them  to  communicate  with  each  other. 

Q.  And  what  are  some  examples  of  social  media  websites? 

A.  Some  examples  might  include  the  website  Facebook,  the 
website  MySpace  as  well  as  Twitter  as  an  example. 

Q.  And  what  is  Twitter? 

A.  Twitter  is  both  a  website  as  well  as  I  guess  you  can 
consider  it  software  that  runs  in  various  platforms  that  allows 
members  of  the  general  public  to  submit  short  messages  which  other 
members  of  the  general  public  can  then  follow  or  subscribe  to. 

Q.  During  the  course  of  an  investigation,  do  you  recall  having 
seen  a  WikiLeaks  organization  Twitter  feed? 

A.  Yes,  the  WikiLeaks  organization  has  a  Twitter  account. 

Q.  And  what  is  the  user  name  or  handle  of  that  account? 

A.  I  believe  it's  just  WikiLeaks. 

Q.  And  generally  why  do  people  use  Twitter?  What's  the 
purpose  of  it? 

A.  Personally  I  would  say  for  entertainment,  however,  you 
could  also  use  it  as  a  method  to  disseminate  information  generally 
widely  to  the  public. 
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1  Q.  And  how  is  Twitter  set  up?  You  know,  my  understanding  of 

2  Facebook  is,  you  know,  you  have  friends  and  those  friends  can  see 

3  your  Facebook  website.  How  is  Twitter  set  up? 

4  A.  Twitter  is  generally  set  up  in  that  any  member  of  the 

5  general  public  can  create  an  account  in  which  they  can  then  post 

6  short  messages.  Other  members  of  the  general  public  can  either  view 

7  those  messages  by  searching  for  that  user  or  their  website  or  they 

8  can  subscribe  to  that  user's  Twitter  feed  which  is  a  long  running 

9  collection  of  messages  directly  and  then  presumably  they  get  those 

10  messages  in  real  time,  or  near  real  time,  as  they  are  submitted  to 

11  the  system  or  the  site. 

12  Q.  And  WikiLeaks  Twitter  feed  you  referred  to  earlier  the 

13  Twitter  account  is  that  accessible  on  the  Internet? 

14  A.  It  is  accessible  by  the  general  public  on  the  Internet. 

15  Q.  And  you  said  there's  a  feed,  what  do  you  mean  by,  a  feed? 

16  Just  that  explain  that  again,  please. 

17  A.  I  would  describe  the  Twitter  feeds  is  basically  a 

18  collection  of  the  messages  that  have  been  submitted  by  a  particular 

19  user  account  and  they  appear  generally  in  chronological  order  with 

20  the  most  recent  message  at  the  top  of  the  feed. 

21  Q.  And  have  you  observed  the  WikiLeaks  Twitter  feed  recently? 

22  A.  Somewhat  recently,  yes. 

23  Q.  And  how  active  is  that  feed? 
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1  A.  It  appears  to  be  very  active.  There  were  messages  about 

2  when  I  last  saw  it  about  this  trial  occurring. 

3  MJ:  When  was  that? 

4  WIT:  I  believe  that  was  also  - 

5  ADC  [CPT  TOOMAN] :  Objection,  Your  Honor,  relevance.  The 

6  recent  feeds  of  WikiLeaks  don't  go  to  any  element  of  the  charges 

7  against  PFC  Manning. 

8  MJ:  Tell  me  the  last  time  you  accessed  it  was. 

9  WIT:  It  was  sometime  after  the  beginning  of  the  Manning  trial. 

10  So,  maybe  the  3rd  or  4th  of  June  of  this  year. 

11  MJ:  What  is  relevant  that  you  are  trying  to  establish? 

12  ATC [CPT  MORROW]:  I'm  just  laying  a  foundation  of  the  witness' 

13  knowledge  of  the  Twitter  feed  that's  all.  Your  Honor. 

14  MJ:  That's  all  I'll  consider  it  for.  Okay.  Go  ahead.  Before 

15  you  continue  your  testimony  was  that  software  that  runs  on  various 

16  platforms,  what  is  a  platform? 

17  WIT:  A  platform  could  be  considered  a  computer,  a  smart  phone, 

18  tablet,  different  types  of  computer  hardware.  Your  Honor. 

19  MJ:  Thank  you. 

20  [END  OF  PAGE] 

21 
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1  Questions  continued  by  the  assistant  trial  counsel  [CPT  MORROW] : 

2  Q.  Now,  have  you  reviewed  --  when  you  recently  reviewed  the 

3  Twitter  feed,  the  WikiLeaks  Twitter  feed,  could  you  tell  whether 

4  there  had  been  Tweets  or  were  the  Tweets  from  you  know  several  years 

5  ago  still  available  to  you? 

6  A.  It  appears  that  all  of  the  publicly  published  messages  from 

7  any  given  account  are  —  remain  on  the  site  indefinitely. 

8  Q.  And  we  talked  about  the  Internet  archive  previously.  Now, 

9  do  you  have  to  use  the  WikiLeaks  or  have  you  had  to  use  the  Internet 

10  archive  to  access  Tweets  from  the  past  in  this  feed  or  are  those 

11  Tweets  still  available? 

12  A.  When  I  attempted  to  look  at  Twitter  messages  on  Internet 

13  archive  I  received  a  message  saying  that  those  were  unavailable,  and 

14  I  generally  assumed  because  of  the  volume  of  messages  that  are  in 

15  archive  does  not  archive  or  catalog  those. 

16  ATC[CPT  MORROW]:  I'm  retrieving  Prosecution  Exhibit  32  for 

17  Identification.  I'm  showing  it  to  defense  counsel. 

18  Q.  Agent  Mander,  I'd  like  you  to  ignore  the  second  of  page  on 

19  this  exhibit.  If  you  would  —  Would  you  please  —  Do  you  recognize 

20  that  document? 


21 

A. 

Yes, 

I  do. 

22 

Q. 

And 

what  is  it? 
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A.  This  is  a  printout  of  the  Google's  cached  version  of  a 
Twitter  message  sent  on  the  WikiLeaks  Twitter  account. 

Q.  And,  again,  what's  the  Google  —  When  you  say  it's  the 
Google  cached  version,  what  do  you  mean  by  that? 

A.  It  is  the  version  that  Google  saves  as  a  search  result  that 
you  can  use  to  view  a  particular  website  if  for  some  reason  that 
website  is  maybe  unavailable  directly. 

Q.  Now,  do  you  have  to  use  the  Google  cache  version  to  access 
the  WikiLeaks  Twitter  feed? 

A.  You  do  not. 

Q.  Let's  talk  about  that  specific  printout.  Is  the  Tweet 
dated? 

A.  The  message  is  dated.  It's  dated,  8  or  possibly  6  January 
of  2010. 

ATC [CPT  MORROW]:  Your  permission  to  publish  to  the  Court. 

MJ:  Go  ahead. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
the  exhibit  for  the  Court.] 

Q.  That's  kind  of  hard  to  see.  Agent  Mander,  but  I  want  to 
talk  about  some  of  the  sort  of  graphics  behind  the  message.  Have  you 
seen  --  first,  can  you  describe  sort  of  that  graphic? 

A.  The  background  graphic  appears  to  be  repeated  four  times 
horizontally.  It  appears  to  be  I  guess  you  could  describe  it  as  two 
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1  globes  that  are  in  an  hour  glass  and  they  appear  to  be  —  the  top 

2  upper  most  one  appears  to  be  dripping  to  the  lower  one. 

3  Q.  And  have  you  seen  that  graphic  like  that  before? 

4  A.  That  appears  to  be  the  logo  or  graphic  that  is  typically 

5  permanently  displayed  on  the  WikiLeaks  website. 

6  Q.  Now,  Agent  Mander,  you  said  this  is  a  representation  of 

7  something  you  printed,  or  explain  exactly  what  this  is  again,  please? 

8  A.  Sometimes  we  take  what  we  call  a  screen  capture  which  is  a 

9  —  we  can  use  various  types  of  software  to  actually  take  I  guess  what 

10  you  could  call  a  picture  of  the  computer  screen,  the  monitor, 

11  whatever  we're  looking  at,  and  then  save  it  as  a  graphics  file.  So 

12  you'll  actually  see  in  the  bottom  right-hand  corner  some  of  the 

13  information  from  my  computer  as  well  as  what  other  windows  I  had 

14  opened  down  in  the  bottom.  That's  kind  of  hard  to  see  from  this,  but 

15  it's  there. 

16  Q.  And  did  you  —  what  do  you  after  you  observed  this  on  the 

17  web  page?  What  did  you  do? 

18  A.  I  believe  I  took  a  screen  capture  of  the,  you  know,  what  I 

19  was  looking  at  and  this  item  was  printed  out  and  —  can  you  move  it 

20  up  so  I  can  see  the  - 

21  Q.  Sure. 
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1  A.  -  very  bottom?  On  the  very  bottom  is  the  time  and  date 

2  of  when  this  item  was  printed,  and  then  those  are  my  initials  that  I 

3  actually  put  on  the  printed  page. 

4  ATC[CPT  MORROW]:  Your  Honor,  the  prosecution  offers 

5  Prosecution  Exhibit  32  for  Identification  into  evidence  as 

6  Prosecution  Exhibit  32. 

7  ADC  [CPT  TOOMAN] :  We  will  object,  Your  Honor.  Again,  personal 

8  knowledge.  The  witness  used  a  web  cache.  Didn't  actually  view  the 

9  Tweet  on  the  date  reported  to  be  and  also  relevance  because,  again, 

10  not  viewed  on  --  I  guess  viewed  on  1  June  so  it  wouldn't  be  relevant 

11  and  I  guess  again  personal  knowledge  of  how  Google  - 

12  MJ:  Do  you  want  to  voir  dire  the  witness  with  respect  to  his 

13  personal  knowledge  on  Google  cache? 

14  ADC  [CPT  TOOMAN] :  I  would  like  to,  yes.  Your  Honor. 

15  ATC [CPT  MORROW]:  May  I  ask  a  few  questions  first.  Your  Honor? 

16  MJ:  Yes,  go  ahead  and  finish  and  then  you  can  go. 

17  Questions  continued  by  the  assistant  trial  counsel  [CPT  MORROW] : 

18  Q.  With  respect  to  this  Tweet  specifically,  did  you  read  the 

19  Tweet? 

20  A.  The  message  that  is  Tweeted  is,  'have  encrypted  videos  of 

21  U.S.  bomb  strikes  on  civilians  http://bit.ly/wlafghan2.  We  need 

22  super  computer  time.  Http: //ljsf . org/' . 

23  Q.  Again,  what  —  when  is  that  Tweet  dated? 
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1  A.  It  appears  to  be  either  6  or  8  January  of  2010. 

2  Q.  And  have  you  seen  that  Tweet  before  in  another  context 

3  other  than  the  Google  cache? 

4  A.  This  Tweet  is  also  on  the  WikiLeaks  Twitter  account. 

5  Q.  So  how  would  you  find  that  Tweet  on  the  WikiLeaks  Twitter 

6  account? 

7  A.  One  of  two  ways.  You  could  either  do  a  search  for  it  using 

8  something  like  Google  and  then  go  directly  to  the  Twitter  page  that 

9  has  that  message  or  you  could  go  to  Twitter  look  for  the  WikiLeaks 

10  account  and  then  presumably  scroll  through  all  of  their  messages 

11  until  you  found  this  particular  one. 

12  Q.  And  have  you  done  that  as  part  of  this  case? 

13  A.  I  did  the  first  mentioned  way.  There  was  I  believe  like 

14  thousands  of  Twitter  messages.  So  I  did  not  read  every  single  one. 


15 

Q. 

But  you  read  this  one? 

16 

A. 

Yes,  I  saw  this  one. 

17 

Q. 

And  you  printed  this  one? 

18 

A. 

I  did. 

19 

Q. 

Do  you  recall  when  that  was' 

20  A.  That  was  sometime  ago.  That  was  maybe  last  year. 

21  ATC [CPT  MORROW]:  I'm  retrieving  the  exhibit  from  the  witness. 

22  MJ:  Are  you  finished? 

23  ATC [CPT  MORROW]:  Yes,  Your  Honor. 
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MJ:  All  right. 

ATC [CPT  MORROW]:  With  respect  to  that  Tweet. 

MJ:  So,  you  have  more  coming? 

ATC [CPT  MORROW]:  I  have  more  one  Tweet  coming. 

MJ:  All  right.  Are  you  anticipating  the  same  objection? 

ADC  [CPT  TOOMAN] :  We  would,  yes.  Your  Honor. 

MJ:  All  right.  Why  don't  we  just  go  through  it  and  then  you'll 

get  your  chance.  Go  ahead. 

ATC [CPT  MORROW]:  I'm  retrieving  Prosecution  Exhibit  31  for 

Identification  from  the  court  reporter.  I'm  handing  the  witness 
what's  been  marked  as  Prosecution  Exhibit  31  for  Identification. 

Questions  continued  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  Agent  Mander,  do  you  recognize  that  document? 

A.  Yes,  I  do. 

Q.  And  what  is  it,  and,  again  just  concentrate  on  the  first 

page? 

A.  This  document  is  a  screen  capture  showing  another  Tweet 
from  a  WikiLeaks  website  as  cached  by  Google. 

Q.  And  what  date  is  that  Tweet? 

A.  The  date  of  the  Tweet  is  7  May  2010. 

Q.  And  what's  the  content  of  the  message? 
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1  A.  The  message  reads,  'We  would  like  a  list  of  as  many  .mil  e- 

2  mail  addresses  as  possible.  Please  contact  editor@WikiLeaks.org  or 

3  submit' . 
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Q.  And  you  viewed  this  Tweet  using  Google  cache  on  your 
computer? 

A.  I  did. 

Q.  And  what  did  you  do  after  you  observed  the  Tweet? 

A.  I  took  a  screen  capture  and  then  printed  out  that  screen 
capture,  and  initialed  the  printed  page  that  it  was  printed  out. 

Q.  And  did  you  do  that  at  the  same  time  as  the  other  Tweet  we 
just  talked  about? 

A.  Roughly  at  the  same  time. 

Q.  Approximately? 

A.  Yes. 

Q.  And  with  respect  to  Prosecution  Exhibit  31  for  ID,  you 
talked  —  we  previously  talked  about  the  background.  I'll  just  hand 
it  back  to  you.  The  background  text,  the  graphics,  and,  again,  where 
have  you  seen  those  —  that  background  text  and  graphics? 

A.  The  background  graphics  appear  to  be  identical  to  the  other 
Tweet,  and  I've  seen  the  same  similar  graphic  on  the  WikiLeaks.org 
website . 

Q.  Have  you  seen  that  message  before  in  the  WikiLeaks  Twitter 
feed,  not  in  a  Google  cache  form? 
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A.  Yes.  It's  still  available  on  the  actual  Twitter  account  of 
their  feed  from  the  WikiLeaks  Twitter  account. 

Q.  When  did  you  see  that  Tweet  in  the  regular  WikiLeaks 
Twitter  feed? 

A.  That  was  sometime  ago,  and  I  don't  remember  the  exact  date. 

Q.  Was  it  approximately  the  same  date  as  you  the  saw  the  other 

Tweet? 

A.  Yes. 

Q.  And,  again,  what  did  you  do  at  that  time  with  that  Tweet? 

A.  Essentially  something  similar,  took  a  screen  capture  or 

printed  the  Tweet  onto  paper  and  then  initialed  that  piece  of  paper. 

ATC[CPT  MORROW]:  I'm  retrieving  Prosecution  Exhibit  31  for 

Identification  and  handing  it  to  the  court  reporter.  Your  Honor,  we 
would  move  to  admit  this  exhibit  for  Identification  as  well. 

MJ:  All  right.  I  assume  the  same  objection? 

ADC  [OPT  TOOMAN] :  Yes,  ma'am. 

MJ:  Okay.  And  what  is  your  objection  to  Prosecution  Exhibits 

31  and  32? 

ADC  [OPT  TOOMAN] :  Your  Honor,  we  would  object  on  hearsay.  We 

would  also  object  that  the  witness  has  no  personal  knowledge,  can't 
authenticate  them.  No  personal  knowledge  of  how  Google  creates  their 
cache . 
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1  MJ:  If  I'm  understanding  the  government's  position,  they're  not 

2  offering  it  to  admit  on  that  basis,  they're  offering  to  admit  it  on 

3  the  prior  or  both,  what  are  you  doing? 

4  ATC[CPT  MORROW]:  Your  Honor,  we  actually  have  the  prior  version 

5  printed  and  that  was  produced  in  discovery  as  well.  The  reason  we 

6  didn ' t  - 

7  MJ:  On  what  basis  are  you  moving  to  admit  these? 

8  ATC [CPT  MORROW]:  Excuse  me? 

9  MJ:  On  which  basis  are  you  moving  to  admit  these  two  exhibits? 

10  ATC [CPT  MORROW]:  We  are  not  offering  either  exhibit  for  the 

11  truth. 

12  MJ:  I  understand  that. 

13  ATC [CPT  MORROW]:  We're  offering  it  for  its  effect  on  PFC 

14  Manning. 

15  MJ:  Are  you  offering  the  Google  cache  or  are  you  offering  the 

16  prior  look? 

17  ATC [CPT  MORROW]:  We're  offering  the  prior  look  and  we'll 

18  actually  add  that  as  an  Exhibit  Alpha  to  these  exhibits.  The  reason 

19  that  we  didn't  have  them  on  this  date  is  that  when  we  printed  it's 

20  very  hard  to  see  the  date  of  the  Tweet.  So  we  used  this  color 

21  version  to  insert,  or  to  mark  as  an  exhibit  so  that  the  date  could  be 

22  readable.  We  can  —  we  will  certainly  —  can  attach  or  mark  the 
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other  version  that  Agent  Mander  has  printed  and  initialed  as  well  and 
add  that  to  the  record. 

MJ:  All  right.  Go  ahead  Captain  Tooman . 

ADC [CPT  TOOMAN]:  Thank  you,  ma'am. 

VOIR  DIRE  EXAMINATION 

Questions  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Just  a  few  guest ions  for  you  about  your  knowledge  of  Google 
cache  and  Twitter.  Do  you  personally  have  a  Twitter  account? 

A.  I  do  not. 

Q.  Do  you  have  any  knowledge  of  how  Twitter  archives  their 
messages? 

A.  When  you  say  knowledge,  can  you  be  more  specific? 

Q.  Do  you  know  how  they  do  it? 

A.  I  don't  know. 

Q.  Do  you  know  the  process  they  go  through  in  order  to  save 
Tweets? 


Q.  Do  you  know  if  a  Tweet  can  be  deleted? 

A.  I  do  not  know  for  certain,  no. 

MJ:  Yes? 

ATC [CPT  MORROW] :  Your  Honor,  if  it  would  help  the  Court  we 

are  simply  offering  this  for  what  it  purports  to  be  which  is  simply  a 
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printout  of  a  web  page.  So  his  knowledge  of  Twitter  is  not 
necessarily  relevant. 

MJ:  I'm  going  to  overrule  that.  Go  ahead. 

Q.  Agent  Mander,  I  want  to  talk  to  you  about  Google  cache.  Do 
you  know  how  Google  goes  about  creating  their  cache? 

A.  Specifically  the  technical  aspects,  no. 

Q.  Do  you  know  where  their  servers  are  located? 

A.  I  believe  they  have  servers  located  in  many  places. 

Q.  Do  you  know  where  the  servers  are  located  that  service  the 
cache? 

A.  I  do  not. 

Q.  Do  you  know  how  often  Google  goes  out  and  creates  their 
cache,  how  often  they  go  out  and  grab  data? 

A.  I  do  not. 

Q.  And  do  you  know  if  they  use  a  program  or  a  proprietary 
algorithm  in  order  to  grab  that  information? 

A.  I  would  assume,  yes,  they  do. 

Q.  You  assume  that,  but  do  you  actually  know? 

A.  I  do  not. 

Q.  Do  you  know  the  frequency  with  which  Google  goes  out  and 
grabs  information? 

A.  I  do  not. 
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Q. 

Do  you  know  if  there's  any  way  that  a  web  page  could 

prevent 

Google  from  grabbing  it? 

A. 

I  believe  the  robot. text  file  that  we  talked  about  before 

is  a  method, 


Q. 

And  as  you  answered  before  when  we  were  talking  about 

archive . 

. org,  do  you  also  not  know  whether  or  not  WikiLeaks.org 

employs 

one  of  those  robot. text  files? 

A. 

I  do  not  know  if  they  employ  one  of  those  files. 

Q. 

Now,  there  were  a  couple  of  dates  on  these  Tweets  that  were 

hard  to  read.  Did  you  ever  actually  look  at  Twitter  on  those  dates? 
So  6  January  or  8  January  2010,  did  you  look  at  Twitter  on  that  day? 


A. 

I  did  not. 

Q. 

Do  you  know  if  the  Google  cache  servers  have  ever  been 

hacked? 


A. 

I  do  not  know  that . 

Q. 

Do  you  know  if  anyone  has  ever  tried? 

A. 

I  do  not  know  that. 

Q. 

Do  you  know  the  operating  system  that  Google  cache  runs? 

A. 

I  do  not  know  that. 

Q. 

Do  you  know  if  they  have  backups  of  their  servers? 

A. 

I  have  no  actual  knowledge  of  that,  no. 

ADC  [CPT  TOOMAN] :  Thank  you  Agent  Mander.  Your  Honor,  we 

would  renew  our  objections  authentication  for  Prosecution  Exhibit  31 
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for  Identification  and  32  for  Identification  as  well  as  is  hearsay. 

Your  Honor,  and  we'll  address  the  other  versions  I  guess  - 

MJ:  I  believe  the  government  told  me  that  they're  offering  it 

for  nonhearsay  purposes.  Is  that  correct? 

ATC [CPT  MORROW]:  We  are.  Your  Honor. 

MJ:  What  is  that? 

ATC [CPT  MORROW]:  With  respect  to  the  7  May  Tweet  we're 

offering  it  for  —  offering  the  Tweet  for  its  effect  on  the  listener. 
7  May  2010,  that  is  the  .mil  e-mail  addresses. 

MJ:  Okay.  I'm  sorry,  I  interrupted  you.  Authentication  and 

hearsay  with  respect  to  Prosecution  Exhibits  31  and  32,  right? 

ADC  [CPT  TOOMAN] :  Yes,  ma'am. 

MJ:  And  Prosecution  Exhibit  109  you  have  --  your  objection  to 

that  one  was? 

ADC  [CPT  TOOMAN] :  109  would  be  the  same.  Your  Honor,  as  well 

as  relevance. 

MJ:  Do  you  have  any  redirect? 

REDIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  Agent  Mander,  well,  just  a  couple  of  questions.  Do  you  know 
how  to  use  the  Internet? 

A.  Yes. 

Q.  Do  you  know  how  to  navigate  to  a  web  page  on  the  Internet? 
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1  A.  Yes. 

2  Q.  And  in  this  case  have  you  navigated  to  web  pages  on  the 

3  Internet? 

4  A.  I  have. 

5  Q.  And  give  me  a  couple  of  examples  of  web  pages  you've 

6  navigated  to  on  the  Internet  that's  part  of  this  investigation? 

7  A.  The  WikiLeaks  website,  the  Facebook  profile  of  PFC  Manning, 

8  the  Twitter  messages  that  we've  discussed  as  well  as  the  archived 

9  versions  of  various  other  sites.  Need  more  examples? 

10  Q.  No,  I  think  that's  enough.  Thank  you. 

11  MJ:  All  right,  temporary  excusal  for  this  witness  or  permanent 

12  excusa'  . 

13  ADC  [CPT  TOOMAN] :  I'm  sorry.  Your  Honor,  at  least  I  was 

14  personally  under  the  impression  that  I  just  voir  dired  the  witness. 

15  MJ:  You  have  further  cross-examination? 

16  ADC  [CPT  TOOMAN]:  Yes,  ma'am. 

17  MJ:  Okay.  I  didn't  realize  that.  I  guess  you're  still  on  your 

18  direct  examination. 

19  ATC [CPT  MORROW]:  I  am,  so  I  guess  I'm  looking  for  my  direct, 

20  so  give  me  a  second. 

21  MJ:  Would  the  this  been  a  good  time  to  recess  the  Court  for 

22  about  10  minutes. 

23  ATC [CPT  MORROW]:  Absolutely,  Your  Honor. 
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ADC  [CPT  TOOMAN] :  No  objection.  Your  Honor. 

MJ:  All  right.  Is  10  minutes  enough? 

ATC [CPT  MORROW]:  Yes,  ma'am. 

ADC [CPT  TOOMAN]:  Yes,  ma'am. 

MJ:  All  right.  The  Court  is  in  recess  until  1715.  Agent 

Mander,  please  don't  discuss  your  testimony  or  knowledge  of  the  case 
with  anyone  while  the  Court  is  in  recess. 

[The  court-martial  recessed  at  1708,  10  June  2013.] 

[The  court-martial  was  called  to  order  at  1720,  10  June  2013.] 

MJ:  Court  is  called  to  order.  Let  the  record  reflect  all 

parties  present  when  the  court  last  recessed  are  again  present  in 
court.  The  witness  is  in  the  courtroom.  You  are  reminded  you  are 
still  under  oath.  Proceed. 

ATC [CPT  MORROW]:  Your  Honor,  at  this  time  the  prosecution  has 

no  further  questions  for  Agent  Mander. 

MJ:  Captain  Tooman. 

ADC  [CPT  TOOMAN]:  Thank  you,  ma'am.  Ma'am,  before  I  begin  my 

cross  examination  I’d  like  to  ask  two  voir  dire  questions  - 

MJ:  That's  fine. 

ADC [CPT  TOOMAN]:  -  of  the  witness  with  respect  to  the 

Tweets  and  the  government  assertion  that  they  would  like  to  admit  it 
for  the  effect  of  the  listener. 

MJ:  Okay. 
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VOIR  DIRE  EXAMINATION 

Questions  by  the  assistant  defense  counsel  [CPT  TOOMAN] 


Q. 

Agent  Mander,  did  you  do  find  any  evidence  that  PFC 

Manning  - 

--  over  the  course  of  your  investigation,  did  you  find  any 

evidence 

that  PFC  Manning  actually  viewed  those  Tweets? 

A. 

I  personally  did  not. 

Q. 

Did  you  look  for  it?  Did  you  look  for  that  evidence? 

A. 

I  did  not  personally  look  for  that  evidence. 

ADC 

[CPT  TOOMAN] :  I  guess  for  our  objection.  Your  Honor,  we 

would  add  relevance  if  there's  no  the  evidence  that  PFC  Manning 


actually 

saw  at  Tweets  there  could  be  no  effect  on  him. 

MJ: 

All  right.  So  you  have  three  objections  to  all  three  of 

them? 


ADC 

[CPT  TOOMAN] :  Yes,  ma'am. 

MJ: 

Okay.  Relevance,  authentication,  and  hearsay. 

ADC 

[CPT  TOOMAN]:  Yes,  ma'am. 

MJ: 

Got  it. 

Questions  continued  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Agent  Mander,  I'd  like  to  talk  just  a  little  bit  about  your 
investigation  generally.  Sort  of  the  tenant  of  your  profession  is 
that  if  you  do  something  you  document  it. 

A.  Yes. 
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Q.  And  if  you  find  a  lead  or  a  clue  you're  going  to  document 
that  as  well,  correct? 

A.  Yes. 

Q.  If  you  talk  to  a  witness  you'll  document  that? 

A.  Yes. 

Q.  If  you  researched  something  and  uncover  something  relevant 
to  the  investigation  you  would  document  it? 

A.  Yes. 

Q.  Now,  over  the  course  of  your  investigation  in  this  case  you 

did  a  lot  of  different  types  of  things  you  talked  about  on  direct 
examination.  You  did  witness  interviews? 

A.  Yes. 

Q.  You  —  I  think  you  reviewed  e-mails? 

A.  Yes. 

Q.  You've  reviewed  chats? 

A.  Yes. 

Q.  You  also  reviewed  financial  transactions? 

A.  Could  you  be  more  specific? 

Q.  Did  you  look  at  banking  records  as  well? 

A.  I  don't  remember  specifically  looking  at  any  banking 
records  personally. 

Q.  Okay.  So  when  you're  looking  at  those  various  things,  if 
you  have  something  important  you  put  it  up,  you  write  it  down  in  an 
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AIR  and  you  notify  kind  of  everyone  who  is  involved  that,  hey,  we've 
got  this  lead  and  let's  go  after  this,  correct? 

A.  Generally  speaking,  yes. 

Q.  Now,  thinking  about  all  the  things  that  you  looked  at  in 

this  case  you  looked  at  chats  and  e-mails  and  witness  interviews. 

When  you  were  investigating  this  case  you  knew  what  PFC  Manning  was 
accused  of,  correct? 

A.  Generally,  yes. 

Q.  You  knew  generally  what  the  charges  were  against  him? 

A.  Depending  on  what  point  of  the  investigation  initially,  no, 
there  weren't  any  charges  for,  you  know,  extended  period  of  time. 

Q.  Okay. 

A.  And  I  believe  the  charges  at  some  point  were  modified,  and 
I  don't  know  the  legal  term  for  that  but. 

Q.  Okay.  But  when  there  were  charges  you  knew  what  they  were 
and  when  the  charges  changed  you  knew  what  they  were  at  that  point  as 
well? 

A.  Generally  speaking,  yes. 

Q.  Over  the  course  of  your  investigation  you  didn't  find  any 
evidence  that  PFC  Manning  had  antiAmerican  beliefs,  correct? 

A.  Well,  as  we  discussed  when  we  had  an  interview,  yourself 
and  myself,  there  was  one  thing  that  I  mentioned  to  you  that  was 
brought  up  by  a  witness  of  this  case. 
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Q.  But  not  a  witness  you  personally  interviewed? 

A.  Correct. 

Q.  So  in  the  course  of  your  investigation,  and  I  just  want  to 
talk  about  the  things  you  did  and  the  things  you  looked  at  and  the 
people  you  talked  to. 

A.  Okay. 

Q.  You  didn't  find  any  evidence  or  any  indication  that  PFC 
Manning  was  antiAmerican  that  he  hated  America? 

A.  No. 

Q.  You  also  didn't  find  any  evidence  that  PFC  Manning  was 
trying  to  help  the  enemy,  that  he  wanted  to  affirmatively  give 
something  to  the  enemy? 

A.  Is  that  a  question? 

Q.  Yes.  You  never  found  anything  in  witness  interviews, 
chats,  e-mails  where  PFC  Manning  said  something  like  I  want  to  help 
the  enemy? 

A.  I  did  not  find  anything  where  he  said  he  wanted  to  help  the 
enemy . 

Q.  Okay.  You  also  reviewed  a  lot  of  communications  with 
individuals  and  you  would  have  noted  any  contact  with  the  more  than 
nationals  you  would  have  noted,  correct? 

A.  Correct. 
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Q.  And  you  noted  some,  you  found  out  some  because  PFC  Manning 
lived  in  Wales  for  a  while  so  you  had  foreign  contacts,  correct? 

A.  Yes. 

Q.  And  for  a  while  that  was  kind  of  a  focus  of  your 
investigation  you  thought  that  maybe  PFC  Manning  was  working  for  some 
sort  of  foreign  intelligence  service,  correct? 

A.  That  wasn't  really  the  CID  focus.  That  was  probably  more 
of  the  Army  Military  Intelligence  focus. 

Q.  Okay.  But  when  you  were  conducting  your  interviews  you 
certainly  explored  that  idea,  didn't  you? 

A.  Yes,  that  was  a  question  that  we  would  have  asked. 

Q.  And  you  didn't  find  any  evidence  that  he  was  associated 
with  any  sort  of  foreign  intelligence  service,  correct? 

A.  I  did  not  personally  find  that,  no. 

Q.  You  also  didn't  find  any  evidence  that  PFC  Manning  was  paid 
in  any  way  for  any  releases  he  may  have  done? 

A.  I  did  not  personally  find  out  find  any  information  that  he 
was  paid. 

ADC [CPT  TOOMAN] :  At  this  time  I'm  going  to  retrieve  what's 

been  marked  as  Defense  Exhibit  Alpha  for  —  I'm  sorry  Foxtrot  for 
Identification.  I'm  handing  Defense  Exhibit  Foxtrot  for 
Identification  to  the  witness. 

Q.  Agent  Mander,  do  you  recognize  that  document? 
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A.  Yes,  I  do. 

Q.  What  is  it? 

A.  This  appears  to  be  a  printout  of  a  web  page  on 
WikiLeaks.org  website. 

Q.  How  do  you  know  that? 

A.  I  printed  this  out  and  my  initials  appear  on  the  lower 
right-hand  corner  of  each  page. 

Q.  How  did  you  —  How  did  you  find  that  document? 

A.  This  document  is  a  variation  of  the  other  document  that  the 

prosecution  mentioned  earlier. 

MJ:  Which  other  document? 

WIT:  Say  again? 

MJ:  Which  other  document? 

WIT:  I  believe  it's  Exhibit  110,  if  I'm  not  mistaken,  ma'am. 

ADC [CPT  T00MAN] :  Prosecution  Exhibit  110,  Your  Honor. 

WIT:  And  this  document,  the  other  document  as  well  as  some  other 
information  relating  to  this  most  wanted  leaks  of  2009  document  were 
revealed  via  search  on  the  Internet  specifically  using  Google. 

Q.  Okay.  And  you  did  that  search? 

A.  I  did  that  search. 

Q.  And  you  printed  that  document? 

A,  I  printed  that  document. 
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ADC [CPT  TOOMAN] :  I'm  going  to  retrieve  Prosecution,  or  I'm 

sorry.  Defense  Exhibit  Foxtrot  for  Identification  and  request  the 
Court's  permission  to  publish  it? 

MJ:  Proceed. 

[There  was  a  brief  pause  while  the  assistant  defense  counsel 
published  the  exhibit  to  the  Court.] 

Q.  Now,  you  testified  about  a  similar  document  on  direct. 

What  is  different  about  this  document.  Agent  Mander? 

A.  Well,  the  most  notable  difference  from  Exhibit  110  on  the 
top  there  where  it  says,  'draft : themostwantedleaksof 2009' ,  on  the 
other  document  Exhibit  110  document  at  the  end  of  2009  there's  the 
word  hyphen,  well  excuse  me,  there's  a  hyphen  and  then  the  word  sort, 
S-O-R-T. 

Q.  Would  you  agree  with  me  that  this  document  also  includes  a 
little  bit  more  information  at  the  top  of  the  document? 

A.  The  documents  are  similar,  but  different. 

Q.  Would  you  agree  that  this  —  Defense  Exhibit  Foxtrot  has 
more  introductory  information  than  Prosecution  Exhibit  110? 

A.  Yes  in  the  list  of  countries  on  the  right  versus  the  left 
and  there's  obviously  some  other  differences  as  well. 

Q.  The  biggest  difference  would  be,  you  would  agree  would  be 
that  and  I'm  pointing  you  to  the  very  first  paragraph  here  at  the 
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government,  correct? 

A.  I  would  have  to  see  both  documents  again. 

Q.  Okay. 

A.  And  look  at  them. 

ADC [CPT  TOOMAN] :  I'll  retrieve  Prosecution  Exhibit  110, 

please.  I'm  going  to  hand  Prosecution  Exhibit  110  to  the  witness. 

WIT:  I'm  sorry,  could  you  repeat  your  question? 

Q.  Would  you  agree  that  the  introductory  portion  of  the 
Defense  Exhibit  Foxtrot  for  Identification  is  not  included  on 
Prosecution  Exhibit  110?  Just  there  on  the  first  page  —  actually, 
look  through  the  entire  document  and  just  make  sure  for  me  that  it 
doesn't  appear  anywhere  in  there. 

A.  [Reviewing  the  document.]  The  paragraph  on  the  displayed 
version  does  not  appear  to  be  in  this  document. 

ADC [CPT  TOOMAN]:  I'm  going  to  retrieve  Prosecution  Exhibit 

110  from  the  witness.  Returning  them  to  the  court  reporter. 

MJ:  May  I  see  both  of  those  exhibits  quickly? 

ADC [CPT  TOOMAN]:  Yes,  ma'am. 

MJ:  Well,  you  haven't  introduced  yours  yet? 

ADC [CPT  TOOMAN]:  Not  yet,  ma'am. 

MJ:  Go  ahead.  I  don't  need  it.  Go  ahead. 
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1  ADC [CPT  TOOMAN] :  I'm  giving  Prosecution  Exhibit  110  to  the 

2  court  reporter. 

3  Questions  continued  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

4  Q.  Now,  Agent  Mander,  you  would  agree  with  me  that  this 

5  version  Defense  Exhibit  Foxtrot,  includes  more  information  about  how 

6  this  list  was  populated,  correct?  And  if  you  need  to  take  a  moment 

7  to  read  that,  please,  do. 

8  A.  This  version  is  an  editable  version  so  that  general  members 

9  of  the  public  can  edit  this  version. 

10  Q.  And  what  this  version  says  at  the  top  is  that  the  most 

11  wanted  leaks,  the  concealed  documents  are  what  they  are,  the 

12  concealed  documents  are  recordings  most  sought  after  by  a  country' s 

13  journalists,  activists,  historians,  lawyers,  police,  or  human  rights 

14  investigators.  Do  you  agree  with  that? 

15  A.  That's  a  paraphrase  of  what  it  says,  sir. 

16  Q.  A  paraphrase  or  literally  what  it  says? 

17  A.  Paraphrase  of  what  it  says. 


18 

Q.  Okay.  We' 

i — 1 
i — 1 

try  it  again 

2009' s  most  wanted  leaks-the 

19 

concealed  documents 

are 

recordings 

most  sought  after 

by  a  country' s 

20 

journalists,  activists. 

historians. 

lawyers,  police. 

or  human  rights 

21 

investigators? 

22  A.  That  is  exactly  - 

23  Q.  Is  that  literally  what  it  says? 
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A.  That'  literally  what  it  says. 

Q.  Okay.  And  that  paragraph  didn't  appear  on  the  prosecution 
exhibit,  correct? 

A.  It  did  not. 

Q.  And  you  would  agree  with  me  that  this  demonstrates  kind  of 
the  purpose  of  WikiLeaks.  Would  you  agree  with  that? 

A.  Can  you  be  more  specific? 

Q.  Sure.  You  would  agree  that  this  statement  at  the  beginning 
sets  out  why  WikiLeaks  wants  these  documents  they  don't  —  they  want 
it  because  they  have  been  - 


ATC [CPT  MORROW]:  Objection,  Your  Honor,  speculation. 

MJ:  Ask  some  foundational  questions  about  whether  he  knows  that 

why  WikiLeaks  wants  documents. 

Q.  Agent  Mander,  do  you  know  why  WikiLeaks  wants  documents? 

A.  I  don't  have  the  actual  knowledge  of  why  they  want  specific 
documents.  I  presume  that  - 

MJ:  You  presume  based  on? 

WIT:  My  experience  knowledge  of  this  case. 

Q.  Would  this  document  also  aid  your  presumption? 

A.  Can  you  clarify  your  question? 

Q.  When  reading  this  introductory  paragraph  does  that  I  guess 
inform  your  understanding  of  why  WikiLeaks  wants  documents? 
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A.  It  just  seems  to  say  that  in  2009  those  are  the  most  wanted 
documents  by  those  groups  of  people.  It  doesn't  necessarily  say  why 
WikiLeaks  wants  them. 

Q.  Let's  move  down  to  this  paragraph.  Can  you  see  where  I'm 
pointing  here?  I'm  pointing  to  the  paragraph  that  starts  with, 
'document  other  materials  added,  nominated  must,'  and  you  would  agree 
with  me  that  it  says,  'be  likely  to  have  political,  diplomatic, 
ethical,  or  historic  impact  on  release? 

A.  That  is  what  it  says. 

Q.  Okay.  Now,  having  read  that  and  seen  that,  does  that 
inform  your  understanding  of  what  WikiLeaks  —  the  purpose  of 
WikiLeaks  and  what  they  want? 

A.  My  understanding  of  this  document  is  that  they  were  trying 
to  create  a  list  of  documents  that  would  be  the  categories  listed 
below  where  I  just  pointed  out,  things  that  are  political, 
diplomatic,  or  other  things  that  would  be  impactful. 

ADC [CPT  TOOMAN] :  Your  Honor,  at  this  time  the  defense  offers 

Exhibit  Foxtrot  for  Identification  as  Defense  Exhibit  Foxtrot. 

MJ:  Any  objection? 

ATC [CPT  MORROW]:  One  moment.  Your  Honor.  Your  Honor,  the 

objection  would  be  authentication.  We're  not  sure  what  this  document 
purports  to  be  based  on  at  least  the  witness'  testimony. 
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MJ:  All  right.  Tell  me  one  more  time,  you  have  Prosecution 

Exhibit  110,  which  I  did  admit.  I'm  not  asking  the  government,  I'm 
asking  the  witness  now  just  a  question  here.  Prosecution  Exhibit 
110,  and  I  would  like  to  see  that  exhibit  now,  if  I  could,  and 
Defense  Exhibit  Foxtrot  together. 

WIT:  Ma'am,  I'm  handing  you  Defense  Exhibit  Foxtrot  for 
Identification. 

MJ:  Special  Agent  Mander,  Prosecution  Exhibit  110  you've 

already  testified  that  it's  different  from  Defense  Exhibit  Foxtrot. 
Both  of  those  exhibits.  Defense  Exhibit  Foxtrot  for  Identification 
have  your  initials  and  printed  Saturday,  June  1st  on  the  bottom 
right.  Is  that  correct? 

WIT:  That  is  correct. 

MJ:  It  looks  like  the  one  Defense  Exhibit  Foxtrot  is  printed  at 

15:39:36  and  the  Defense  Exhibit  Foxtrot  for  Identification  was  at 
15:37:47.  So  Defense  Exhibit  Foxtrot  for  Identification  came  after  - 
-  you  printed  that  one  after  the  government  exhibit? 

WIT:  If  that's  the  way  the  times  match  up,  yes,  ma'am. 

MJ:  I  just  want  to  ask  the  witness  a  couple  of  questions  here 

just  because  I'm  confused. 

ADC [CPT  TOOMAN] :  Yes,  ma'am. 

MJ:  I'm  going  to  hand  you  both  of  the  exhibits  and  can  you  just 

walk  me  through  how  you  got  them  both  and  what  you  did? 
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WIT:  There  were  some  other  documents  that  accompanied  these. 

Are  those  available? 

ATC [CPT  MORROW]:  Your  Honor,  those  have  been  produced  in 

discovery,  but  they're  not  part  of  the  exhibit. 

MJ:  Okay.  Can  you  tell  me  what  you  did  without  referencing 

those  particular  documents? 

WIT:  Ma'am  basically  conducted  a  search  using  I  believe  the 
words  the  most  wanted  leaks  of  2009,  using  Google.  There  were 
numerous  results  that  came  as  a  result  of  that  search  and  the  first  I 
believe  it  was  the  first  four  contained  three  versions  of  this  list 
or  similarities  to  this  list  and  the  Prosecution  Exhibit  110  was  one 
version  of  that  list.  The,  I  guess  Defense  Exhibit  F  —  excuse  me. 
Foxtrot  is  another  version  of  this  list,  and  there  was  additionally  a 
third  shorter  version  as  well  as  a  video  related  to  the  list. 

MJ:  And  did  you  print  —  you  printed  both  versions  yourself, 

right? 

WIT:  I  believe  I  printed  all  three  versions. 

MJ:  Thank  you.  Government  your  objection  is  authentication  and 

I  admitted  Prosecution  Exhibit  110.  Wouldn't  the  basis  for  admission 
on  authentication  be  the  same? 

ATC [CPT  MORROW]:  Your  Honor,  actually,  the  better  objection 

really  is  relevance.  I'm  not  sure  what  the  relevance  of  this 
specific  exhibit  is. 
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MJ:  Well,  if  Prosecution  Exhibit  110  is  relevant  why  isn't  this 

one  relevant? 

ATC [CPT  MORROW]:  They  haven't  laid  foundation  for  why  this 

one  might  be  relevant. 

MJ:  All  right.  Go  ahead. 

ATC [CPT  MORROW]:  Additionally,  Your  Honor,  we'd  also  object 

on  the  basis  of  hearsay.  What  are  they  offering  it  for? 

MJ:  Go  ahead. 

ADC [CPT  TOOMAN] :  Would  you  like  me  to  respond  to  that.  Your 

Honor? 

MJ:  Yes,  please. 

ADC [CPT  TOOMAN]:  Well,  Your  Honor,  I  guess  most  simply,  you 

admitted  theirs,  it's  the  exact  same  thing  done  the  exact  same  way  so 
it  should  be  admissible.  With  respect  to  hearsay  we  would  say  Rule 
106,  Rule  of  Completeness  if  this  is  basically  the  same  version.  If 
you  look  at  the  URL,  it  is  identical  with  the  exception  of  a  hyphen 
sort . 

MJ:  So,  they  have  the  same  URL  with  the  exception  of  the  hyphen 

sort?  I  didn't  look  at  that  on  the  two  exhibits.  I'm  still 
confused.  So,  when  you  pulled  this  —  you  pulled  it  up,  you  got, 
normally  when  you  search  Google  something  you  get  a  list  of  things. 

WIT:  Yes,  ma'am. 

MJ:  So  they  listed  one,  two,  three,  four  or? 
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WIT:  There  was  —  I  believe  there  was  ten  results  as  a  result  of 
the  search  on  the  page  initially  the  Google  results  and  then  within 
the  first  four  results  were  different  versions  of  this  list,  and 
these  are  two  versions  of  that  list. 

MJ:  I'm  going  to  overrule  the  objection.  Any  others? 

ATC [CPT  MORROW]:  Your  Honor,  the  government  notes  that  we 

think  the  Rule  of  Completeness  would  assume  the  truth  of  the 
statement  or  the  truths  of  the  statement. 

MJ:  Why  does  the  Rule  of  Completeness  assume  the  truth  of  the 

statement? 

ATC [CPT  MORROW]:  At  least  that's  the  government's 

understanding  of  that  Rule,  Your  Honor., 

MJ:  Isn't  Rule  106  --  usually  —  Rule  106  would  normally  be  one 

document  if  part  of  the  document  then  the  other  side  can  bring  in  the 
rest  of  the  document,  right? 

ATC [CPT  MORROW]:  May  I  ask  him  a  couple  of  questions  about 

the  difference  of  the  document? 

MJ:  Go  ahead. 

REDIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  MORROW] : 

Q.  Agent  Mander,  you  said  that  you  searched  for  WikiLeaks  most 
wanted  and  came  up  with  a  number  of  results? 

A.  Yes. 
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Q  What  --  when  a  number  of  results  come  up,  what  does  that 

mean? 

A.  Can  you  be  more  specific? 

Q.  Are  they  —  Were  they  in  the  same  location  on  the  Internet? 

A.  Both  documents  were  on  the  WikiLeaks.org  website. 

Q.  But,  it  wasn't  exactly  —  you  had  to  navigate  from  that 
website  to  another  place  on  the  website.  Is  that  correct? 

A.  When  I  initially  went  to  the  main  WikiLeaks.org  website 
recently  on  June  1st  you  could  not  directly  navigate  to  either  one  of 
these  lists. 

Q.  But  the  —  okay. 

ATC [CPT  MORROW]:  No  further  guestions. 

MJ:  Well,  wait  a  minute  now  I'm  confused  again.  You  printed 

out  those  documents  and  they  say  June  1st.  How  could  you  print  them 
out  if  you  never  got  them? 

WIT:  When  I  used  Google  I  used  the  search  term  the  most  wanted 
leaks  of  2009.  That  resulted  in  numerous  search  results.  These  were 
two  of  those  results.  If  you  go  to  the  WikiLeaks.org  website 
directly  without  searching  for  it  there  are  many  links  and  other 
various  bits  of  information  on  this  page,  however,  there  is  nothing 
that  will  immediately  take  you,  or  nothing  you  can  click  on  that  will 
take  you  to  either  one  of  these  lists  from  their  main  web  page,  their 
home  page.  Does  that  make  it  any  clearer,  ma'am? 
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MJ:  Let  me  just  make  sure  I  understand  your  testimony.  You 

went  on  Google  and  this  isn't  Google  cache,  this  is  just  Google? 

WIT:  This  is  Google. 

MJ:  So  you  go  on  Google,  and  you  found  Defense  Exhibit  Foxtrot 

for  Identification  and  Prosecution  Exhibit  110  in  your  search? 

WIT:  Yes,  ma'am. 

MJ:  And  they  come  up  two  of  the  ten  results  that  you  found? 

WIT:  Yes,  ma'am. 

MJ:  And  then  if  you  go  —  on  June  1st  —  and  you  printed  it  off 

Google? 

WIT:  Correct.  Well,  I  printed  it  off  the  actual  location  where 
the  documents  appeared. 

MJ:  And  then  you  went  to  the  WikiLeaks  website  and  you  couldn't 

access  them  that  way? 

WIT:  You  cannot  navigate  to  them  from  the  home  page  of  the 
WikiLeaks.org  website,  meaning  you  could  not  click  on  anything  on 
that  home  image  that  would  take  you  to  these  documents. 

MJ:  I  think  I  understand.  All  right. 

WIT:  If  I  may  expound  on  that. 

MJ:  Yes. 

WIT:  I  believe  there  was  a  question  in  regards  to,  could  the 
general  public  find  these  on  the  WikiLeaks  website  just  by  going  to 
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the  main  website  and  presumably  they  wouldn't.  They  would  find  them 
doing  a  search,  but  not  going  to  the  website  directly. 

MJ:  Okay.  I'm  still  in  the  same  position  I  was  in  before.  If 

Prosecution  Exhibit  110  comes  in  then  that's  - 

ATC [CPT  MORROW]:  Your  Honor,  we'll  withdraw  the  objection. 

MJ:  -  Defense  Exhibit  Foxtrot  has  the  same  ruling.  Proceed. 

So,  it's  admissible. 

ADC [CPT  TOOMAN] :  Thank  you,  ma'am. 

MJ:  Do  you  want  to  give  it  to  me.  I'll  sign  it. 

ADC [CPT  TOOMAN]:  I'm  sorry,  ma'am? 

MJ:  Do  you  want  to  give  it  to  me  and  I'll  admit  it. 

ADC [CPT  TOOMAN]:  Retrieve  Defense  Exhibit  Foxtrot  and 

Prosecution  Exhibit  110  from  the  witness,  and,  Your  Honor,  Defense 
Exhibit  Foxtrot  and  I'm  going  to  hang  onto  this. 

MJ:  Defense  Exhibit  Foxtrot  for  Identification  is  admitted. 

ADC [CPT  TOOMAN]:  Ma'am,  permission  to  publish  Prosecution 
Exhibit  110? 

MJ:  Go  ahead. 

[There  was  a  brief  pause  while  the  assistant  defense  counsel 
published  the  exhibit  to  the  Court.] 

ADC [CPT  TOOMAN]:  I'm  placing  on  the  overhead  Prosecution 

Exhibit  110,  Page  9. 
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Questions  continued  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Agent  Mander,  you  spoke  on  direct  about  a  number  of  Intel 
Link  searches  that  you  found  that  corresponded  to  things  on 
Prosecution  Exhibit  110,  correct? 

A.  I  did  not  actually  find  the  Intel  Link  searches.  That  was 
someone  else  from  the  forensics  team. 

Q.  Right.  Okay.  You  look  at  the  Intel  Link  searches  and 
testified  that  some  of  the  things  —  the  terms  searched  were  items 
that  were  similar  to  things  on  Prosecution  Exhibit  110,  correct? 

A.  That's  correct. 

ADC [CPT  TOOMAN]:  Okay.  At  this  time  I'd  like  to  retrieve 

Prosecution  Exhibit  81  and  ask  the  witness  to  move  to  the  panel  box. 

MJ:  All  right. 

Q.  I'm  handing  the  witness  what's  marked  as  Prosecution 
Exhibit  81.  Agent  Mander,  what  I'd  like  to  do  is  we're  going  to  go 
through  this  list  and  I'd  like  you  to  tell  me  whether  or  not  there 
are  any  searches  in  Prosecution  Exhibit  81  that  correspond  with  the 
item  on  the  list.  Okay? 

ATC [CPT  MORROW]:  Your  Honor,  the  government  will  stipulate 

that  there  are  a  number  of  searches  for  the  information  on  this  list. 

MJ:  What  do  you  want  him  to  do? 

ADC [CPT  TOOMAN]:  Your  Honor,  the  government  highlighted  I 

think  three  instances  where  PFC  Manning,  or,  rather,  I  should  say. 
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computers  associated  with  PFC  Manning  searched  for  terms  that 
correspond  with  items  listed  on  this  list. 

MJ:  And  you  want  to  go  through  all  of  the  ones  where  —  that 

don't  correspond? 

ADC [CPT  TOOMAN] :  Yes,  ma'am. 

MJ:  And  government  you're  willing  to  stipulate  the  those  three 

are  the  only  ones  that  correspond? 

ATC [CPT  MORROW]:  Yes,  Your  Honor. 

MJ:  All  right.  In  light  of  that,  do  you  need  to  continue? 

ADC [CPT  TOOMAN]:  No,  ma'am. 

MJ:  All  right. 

ADC [CPT  TOOMAN]:  I  will  retrieve  Prosecution  Exhibit  81  from 

the  witness.  I'm  handing  that  back  to  the  government. 

Questions  continued  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Agent  Mander,  if  you  would  please  return  to  the  witness 
stand.  I'm  going  to  hand  you  Prosecution  Exhibit  110  and  I'd  like 
for  you  to  count  how  many  items  are  listed  in  that  exhibit,  please? 

A.  Could  you  define  the  word  item? 

Q.  I'm  sorry,  under  the  United  States.  I  think  it  starts  on 
Page  9 . 

A.  [Reviewing  the  exhibit.]  You  say  items  there  are  bullets. 
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ADC [CPT  TOOMAN] :  Well,  actually.  I'll  retrieve  the  witness  — 

or  I'll  retrieve  the  exhibit  from  the  witness  and  I  will  publish  this 
if  that's  all  right  with  Your  Honor? 

MJ:  That's  fine. 

ADC[CPT  TOOMAN]:  Okay.  I'm  publishing  Page  9  of  Prosecution 

Exhibit  110. 

Q.  So,  Agent  Mander,  if  you  could  please  count  the  items  on 
under  United  States  there? 

A.  Can  you  move  it  down  a  little  bit? 

Q.  Sure.  This  way? 

A.  Yeah,  that's  fine. 

Q.  Okay. 

A.  When  you  say  items,  we're  talking  about  the  bullet  items  -- 

Q.  Yes,  the  bullets,  please. 

A.  -  the  subbullets?  There  are,  one,  two,  three,  four, 

five,  there  are  at  least  five  things  that  I  can  see  different 
categories,  I  guess  you  could  say. 

Q.  Okay.  Well,  let's  go  with  important  bulk  databases.  How 
many  items  are  listed  under  important  bulk  databases? 

A.  There  are  three  categories  of  items. 

Q.  Okay.  And  the  next  is  federal  politics? 

A.  Correct. 
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Q.  How  many  items  are  listed  there? 

A.  There  are  one,  two,  six. 

Q.  Okay.  And  then  next  do  you  see  Military  Intelligence  and 
I'm  going  to  move  this  up  so  we  can  see  all  of  that  subsection.  And 
if  you  could  please  count  I  think  on  here  count  each  bullet  and 
subbullet,  because  it  appears  that  subbulets  —  would  you  agree  with 
me  that  the  subbullets  are  different  than  the  main  bullet? 

A.  Sure,  yes. 

Q.  Or  unique  in  some  way? 

A.  Yes. 

Q.  Okay.  So,  if  you  would  count  those  bullets  for  me. 

A.  It  appears  to  be  21  bullets  there. 

Q  Okay.  And  I'm  now  going  to  remove  Prosecution  Exhibit  — 

or  Page  9  of  the  exhibit  and  put  on  Page  10  to  the  overhead.  Can  you 
see  that  okay.  Agent  Mander? 

A.  Yes. 

Q.  Okay.  If  you  would  please  count  for  me,  we're  still  under 
Military  Intelligence.  So  we're  continuing  from  21. 

A.  Fifty-five  excuse  me  56. 

Q.  Fifty-six  visible  on  the  screen  there? 

A.  Yes. 
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Q.  And  the  last  one  you  see  just  for  the  record  is  blueprints 
and  floor  plans  of  all  unmentioned  facility  in  the  federal  relocation 
arc  including  historical  ones? 

A.  That's  correct. 

Q.  So  54  to  there  under  Military  and  Intelligence,  correct? 

A.  Didn't  I  say  56? 

Q.  I'm  sorry,  56.  I'm  now  moving  Page  10  up.  How  many  under 
banking? 


A.  There  are  two  bulleted  items. 

Q.  And  one  under  environment? 

A.  That  is  correct. 

Q.  Two  under  media? 

A.  That  is  correct. 

Q.  And  two  under  religion? 

A.  That  is  correct. 

Q.  Okay.  I'm  removing  Page  10  and  placing  Page  11  on  the 
overhead  and  will  continue  with  religion.  How  many  more  do  we  have 
there? 


A.  There  are  six  more  on  this  page. 

Q.  Okay.  I'm  removing  Page  11  and  returning  Prosecution 
Exhibit  110  to  the  court  reporter. 

ADC [CPT  TOOMAN] :  No  further  questions.  Your  Honor. 

MJ:  All  right.  Redirect? 
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ATC [CPT  MORROW]:  No,  Your  Honor. 

MJ:  Temporary  or  permanent  excusal? 

ATC [CPT  MORROW]:  Temporary,  Your  Honor. 

[The  witness  was  duly  warned,  temporarily  excused,  and  withdrew  from 
the  courtroom . ] 

MJ:  In  the  progression  of  your  case  is  the  next  piece  of  it  a 

stipulation  of  expected  of  expected  testimony  or  is  it  a  witness? 

TC [MAJ  FEIN]:  It's  actually  a  witness  that's  sitting  right  out 
here,  ma'am,  ready  to  go. 

MJ:  All  right.  A  long  or  a  short  witness? 

TC [MAJ  FEIN]:  United  States  thinks  she's  pretty  short,  ma'am, 
it's  Ms.  Glenn. 

MJ:  Does  either  side  have  any  objection  to  continuing? 

CDC [MR .  COOMBS]:  No,  Your  Honor. 

TC [MAJ  FEIN]:  Ma'am,  the  United  States  calls  Ms.  Shelia  Glenn. 

SHELIA  GLENN,  civilian,  was  called  as  a  witness  for  the  prosecution, 
was  sworn  and  testified  as  follows : 

DIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  OVERGAARD] : 

Q.  And  you  are  Shelia  Glenn? 

A.  Yes,  I  am. 

Q.  You  work  at  Fort  Meade,  Maryland? 

A.  Yes,  I  do. 


8135 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


o 


9 


Q.  What  unit  do  you  work  for  at  Fort  Meade? 

A.  I  work  for  Army  Counterintelligence  Center,  902nd  MI  Group. 

Q.  And  what  is  the  902  MI  Group  do? 

A.  902nd  conducts  counterintelligence  activities  to  protect 
classified  information  and  technologies  and  to  detect,  identify 
foreign  threats  against  U.S.  Army. 

Q.  And  do  you  work  for  a  particular  subgroup  under  the  902nd? 

A.  Yes,  I  do.  I  work  for  Army  Counterintelligence  Center. 

Q.  Okay  and  what  does  the  Army  Counterintelligence  Center  do? 

A.  Army  Counterintelligence  Center  produce  timely,  accurate, 
comprehensive  multi-discipline  analysis  to  support  combating 
terrorism  programs,  ground  system  technologies,  and  investigation 
operation  activities. 

Q.  And  do  you  work  for  a  specific  branch  under  the  Army 
Counterintelligence  Center? 

A.  Yes,  I  do. 

Q.  What  branch  is  that? 

A.  I  work  for  Cyber  Counterintelligence  Assessment  Branch. 

Q.  And  what  does  the  Cyber  Counterintelligence  Assessment 
Branch  do? 

A.  The  Counter  Cyber  Intelligence  Assessment  Branch  identifies 
and  performs  analysis  on  cyber  counterintelligence  threats  to  the 
United  States  Army. 
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Q.  And  what  is  your  job  at  the  Army  —  at  the  Cyber 
Counterintelligence  Assessment  Branch? 

A.  My  job  is  a  senior  analysts  and  my  job  is  to  mentor  junior 
Soldiers  and  also  to  edit  and  review  documents  for  content,  accuracy, 
and - 

Q.  How  many  analysts  do  you  have  there? 

A.  We  have  five  analysts  that  work  under  me. 

Q.  Okay.  And  how  long  have  you  been  in  that  —  the  senior 
analyst  position? 

A.  I've  been  there  for  2  years. 

Q.  And  how  long  have  you  been  at  the  902nd? 

A.  I've  been  at  the  902nd  since  2000. 

Q.  And  what  did  you  do  before  that? 

A  I  was  in  military  for  20  years  and  I  retired  as  Sergeant 
First  Class. 

Q.  What  did  you  do  in  the  military? 

A.  I  spent  5  years  as  a  Cryptographic  Equipment  Repair.  15 
years  as  an  Intelligence  Analyst. 

Q.  What  kind  of  intelligence  analyst? 

A.  All  source  intelligence  analyst. 

Q.  And  what  has  been  your  focus  at  the  902nd?  You  said  you're 
under  the  Cyber  Assessments  Branch? 

A.  Ah,  yes.  My  focus  is  cyber  counterintelligence. 
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Q.  Okay.  And  what  does  that  mean? 

A.  That  means  that  I  look  at  the  foreign  cyber  threat, 

identify  and  assess  that  threat  to  the  United  States  Army 
technologies  and  programs. 

Q.  What  sorts  of  —  you  say  you  have  five  analysts  that  work 
would  under  you? 

A.  Yes. 

Q.  What  sorts  of  work  product  do  the  Cyber  Analysts  in  the 
Cyber  Cl  Branch  of  ACIC  produce? 

A.  The  Cyber  Cl  Analyst  produces  ACIC  special  reports, 
counterintelligence  notes,  inputs  to  FISTUS  [phonetic]  and  input  the 
MCDCIDUS  [phonetic]  cyber  inputs. 

Q.  Okay.  Can  we  just  —  We'll  just  focus  on  the  ACIC  special 
reports  prepared  by  the  Cyber  Cl  Branch.  Can  you  tell  us  how  that 
one  is  distinct  from  the  other  ones  that  you  named? 

A.  The  ACIC  special  report  is  a  comprehensive  document.  It 
uses  I  the  full  spectrum  analysis  and  it  uses  predictive  analysis. 

Q.  And  are  there  different  types  of  these  special  ACIC 
reports? 

A.  Yes,  there  —  Basically  we  write  ACIC  special  reports  based 
on  requirements,  request  for  information,  or  self-initiated. 

Q.  What's  the  purpose  of  this  self-initiated  Cyber  Cl  special 
report? 
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A.  In  a  self-initiated  report  we  identify  potential  threat  to 
U.S.  Army  and  we  inform  the  commander  about  that  threat  to  their 
organization . 

MJ:  Before  you  continue.  You  said  there  were  three  of  them, 

requirements,  something  else  and? 

WIT:  Request  for  information. 

MJ:  Thank  you. 

Q.  And  just  focusing  in  on  the  self-initiating  Cyber  Cl 
special  reports,  can  you  tell  us  how  those  are  prepared? 

A.  Oh,  yes.  Our  first  analyst  comes  up  with  —  First  the 
analyst  while  they  are  doing  their  research  they  come  across  some 
information  that  they  think  might  be  of  a  Cl  interest  to  the  United 
States  Army.  If  it  is,  then  they  talk  about  it  with  their  supervisor 
and  see  if  there's  something  that,  you  know,  that  the  supervisor  will 
approve  for  them  to  go  ahead  and  produce.  So  then  an  analysts  lists 
what  they  know  and  what  they  don't  know  about  that  event  or 
organization  or  whatever  they're  writing  about.  Okay  once  they  look 
at  what  they  have  and  what  they  don't  have,  then  they  start  doing 
research.  They  do  the  research  using  classified  and  unclassified 
reporting. 

Q.  Where  do  they  conduct  this  research? 

A.  They  conduct  this  research  on  classified  systems,  JWICS 
SIPRNET  and  unclassified  systems,  open  source. 
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Q.  What  kinds  of  things  are  they  looking  at  when  they  are 
conducting  their  research? 

A.  They're  looking  at  —  They  are  looking  at  everything. 
They're  looking  at  HUMIT  reporting,  they're  looking  at  SIGINT 
reporting,  they  are  looking  at  OSINT  reporting,  imagery  reporting  and 
massive  reporting. 

Q.  So  after  they  —  After  an  analyst  does  this  research, 
what's  the  next  step  in  creating  this  self-initiating  special  report 
for  Cyber  Cl? 

A.  Okay.  Once  they  finish  their  research,  then  the  analyst 
will  look  at  the  order  of  the  stuff  they  want  to  compile.  So 
basically  build  an  outline  and  they  put  the  information  that  they 
collected  within  that  outline  and  then  they  want  to  answer  the 
questions,  you  know,  the  who,  what,  why,  where,  and  how,  and  then 
they  want  to  say  what's  next.  They  want  to  look  at  what's  next  and 
they  also  look  at  the  impact  against  U.S.  Army  interests  and  U.S. 
interests . 

Q.  And  then  do  they  —  When  do  they  start  writing  their 
product? 

A.  After  they  collect  all  the  information  and  put  it  in  the 
outline  then  they  start  writing  the  product. 

Q.  And  after  —  I  guess  what's  the  process  then  for  writing 
that  product? 
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A.  Okay.  For  writing  the  product  you  pull  all  intelligence 
information  together.  You  look  at  the  impact.  You  group  the 
information  and  then  you  put  it  in  a  template.  We  have  a  template 
for  these  reports.  So,  we  put  it  in  a  template  and  make  sure  that 
you  can  answer  all  the  who,  what,  why,  where,  and  what's  next. 

Q.  And  after  that  report  is  drafted,  what  happens  to  it? 

A.  After  the  report  is  drafted  it  goes  to  the  senior  analyst 

who  reviews  it  for  content,  accuracy,  and  grammar,  and  once  the 
senior  analyst  reviews  it,  then  it  goes  out  for  coordination, 
external  coordination. 

Q.  I'm  going  to  step  back  a  little  bit.  What's  the  content 
and  accuracy  verification?  What  does  that  entail? 

A.  Okay.  When  we  look  at  it  for  content  and  accuracy,  we're 
making  sure  that  information  within  the  report  is  correct.  We  fact 
check  the  sources  that  are  used  in  the  report  to  make  sure  that  they 
agree  with  the  information  within  the  report  states  and  then  we  check 
for  grammar. 

Q.  And  then  you  said  you  send  it  out  for  coordination? 

A.  Yes,  we  do. 

Q.  What  does  that  mean? 

A.  When  we  send  it  out  for  coordination  to  external  sources, 
which  means  we  send  it  to  other  intelligence  agencies  so  they  can 
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actually  review  the  report  to  make  sure  that  have  the  information 
accurately. 

Q.  And  what  happens  after  the  external  coordination? 

A.  When  we  did  get  our  results  back  from  the  external 
coordination  we  check  the  comments  that  the  organizations  put  within 
the  report  and  if  we  agree  with  the  comments  then  we  incorporate  them 
within  the  reports.  If  we  disagree  with  the  comments  then  we  put 
an  alternative  analysis  statement  within  that  report. 

Q.  Is  that  required? 

A.  Yes,  it  is. 

Q.  And  what  happens  after  the  external  coordination,  what 
happens  to  the  product  next? 

A.  External  coordination  of  the  product  is  reviewed  by  the 
branch  chief. 

Q.  It  goes  —  what,  if  anything  new  is  added? 

A.  If  anything  new  is  added  it  goes  back  to  the  senior  analyst 

who  reviews  that  information  and  then  it  goes  to  the  branch  chief. 

Q.  What  happens  —  What  does  a  branch  chief  do? 

A.  The  branch  chief  reviews  the  product  again  for  content, 
accuracy,  and  grammar. 

Q.  What  happens  after  that? 

A.  After  the  product  is  reviewed  by  the  branch  chief  then  it 
goes  to  the  editors  for  them  to  review  it. 
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Q.  Again,  for  content  and  accuracy? 

A.  They  review  it  for  grammar  and  content. 

Q.  Okay. 

A.  I  mean  grammar  and  accuracy.  They  don't  review  it  for 
accuracy,  they  review  it  for  grammar. 

Q.  Okay.  So  what  happens  after  the  editor  is  done? 

A.  Once  the  editors  finish  their  job  then  it  goes  to  the 
director  or  deputy  director  to  be  review  for  content,  accuracy,  and 
grammar . 

ATC [CPT  OVERGAARD] :  Your  Honor,  I'm  going  to  retrieve 
Prosecution  Exhibit  45  for  Identification. 

MJ:  Yes? 

ADC [CPT  TOOMAN] :  I'm  just  going  to  look  at  it.  Your  Honor. 

MJ:  Okay. 

Q.  I'm  handing  Prosecution  Exhibit  45  for  Identification  to 
the  witness.  Can  you  tell  us  what  that  is? 

A.  It's  a  ACIC  special  report. 

Q.  How  do  you  know  that? 

A.  Because  it  states  on  the  top  of  the  document  ACIC  special 
report  and  it  has  a  ACIC  serial  number  on  it. 

Q.  And  you're  familiar  with  those  documents? 

A.  Yes,  I  am. 

Q.  How  are  you  familiar  with  it? 
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A.  We  write  them. 

Q.  Okay.  Have  you  written  them  yourself? 

A.  Yes,  I  have. 

Q.  And  what  type  of  product  is  —  is  that  document  or  is  that 
report  in  particular? 

A.  This  is  a  self-initiated  document. 

Q.  And  who  wrote  that  product? 

A.  Mr.  Mike  Horvath. 

Q.  Who  is  Mike  Horvath? 

A.  Mike  Horvath  was  the  senior  analysis  at  the  time. 

Q.  What  was  your  involvement  in  creating  that  product? 

A.  Mike  discussed  the  subject  with  me  and  I  reviewed  it  for 
content  and  grammar  and  accuracy. 

Q.  So  you're  familiar  with  the  content? 

A.  I'm  familiar  with  the  content,  yes. 

Q.  And  why  did  you  review  the  product? 

A.  Because  we  have  a  two  review  process  within  our 
organization . 

Q.  Is  this  a  product  you  reviewed  in  2008? 

A.  Yes,  it  is. 

Q.  Is  it  different  in  any  way? 

A.  Yes,  it  is. 

Q.  How  is  it  different? 
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A.  It's  been  declassified  and  it's  missing  the  end  notes. 

Q.  Is  the  content  otherwise  the  same? 

A.  Yes,  it  is. 

Q.  And  do  you  —  What  happened  to  the  product  —  what  happened 
to  this  product  in  particular  after  it  went  through  the  process  that 
you  discussed  before? 

A.  It  was  posted  to  our  website. 

Q.  Where  is  your  website? 

A.  On  SIPRNET  and  JWICS. 

Q.  Is  that  product  still  on  the  ACIC  portal? 

A.  Yes,  it  is. 

Q.  How  do  you  know  that? 

A.  I  checked  it. 

ATC [CPT  OVERGAARD] :  Your  Honor,  at  this  time  the  United  States 
moves  to  admit  what  has  been  marked  as  Prosecution  Exhibit  45  for 
Identification  into  evidence  as  Prosecution  Exhibit  45. 

ADC [CPT  TOOMAN] :  No  objection,  Your  Honor. 

MJ:  May  I  see  it,  please?  Prosecution  Exhibit  45  for 

Identification  is  admitted.  Does  the  witness  need  the  document  back? 

ATC  [CPT  OVERGAARD]:  Yes,  ma'am. 

MJ:  There  you  go. 

ATC [CPT  OVERGAARD]:  Thank  you. 
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1  Questions  continued  by  the  assistant  trial  counsel  [CPT  OVERGAARD] : 

2  Q,  Ms.  Glenn,  can  you  tell  us  the  name  of  that  product  that  I 

3  handed  you? 


4  A. 

WikiLeaks.org  a  on-line  reference  to  foreign  intelligence 

5  services. 

insurgents  or  terrorist  groups. 

6  Q. 

What  is  that  letter  and  number  combination  under  the  title 

7  A. 

Underneath  there  is  the  production  center,  first  four 

8  digits,  the  second  is  the  function  code,  the  third  is  the  serial 

9  number,  and  the  last  two  is  the  fiscal  year. 


10  Q. 

And  under  that  what  is  the  publication  date  of  this 

11  document? 


12  A. 

18  March  2008. 

13  Q. 

And  how  about  the  information  cutoff  date? 

14  A. 

28th  February  2008. 

15  Q. 

Can  you  tell  us  what  the  information  cutoff  date  means? 

16  A. 

That's  the  last  current  reporting  that's  contained  in  this 

17  report 


18  Q. 

What  does  it  say  under  the  publication  date? 

19  A. 

National  security  information,  unauthorized  disclosure 

20  subject  to  criminal  sanctions 


21  Q. 

What  is  the  national  security  information? 

22  A. 

Information  that  has  been  determined  that  it  needs  to  be 

23  protected  from  unauthorized  release 
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Q.  What  specific  types  of  national  security  information  are  in 

here? 


A.  Intelligence  reports  produced  by  originators. 

Q.  And  you  already  us  what  the  external  coordination  means, 
but  can  you  tell  us  what  that  line  represents? 

A.  External  coordination? 

Q.  Yes. 

A.  That's  the  organization  that  performed  the  external 
coordination . 

Q.  Okay.  So  that's  who  it  was  sent  to  - 

A.  Yes. 


Q.  -  coordinate  with?  And  how  about  that  next  line?  Can 

you  tell  us  what  that  means? 

A.  Which  one? 

Q.  The  product  response  to  Headquarters,  Department  of  Army? 
A,  That's. 

MJ:  Is  there  at  all  a  way  to  publish  so  that  I  can  follow 

along. 

ATC [CPT  OVERGAARD] :  Yes,  ma'am.  I  can  publish  the  copy  that  I 


have  right  here,  ma'am. 

[There  was  a  brief  pause  while  the  assistant  trial  counsel  published 
the  exhibit  to  the  Court.] 


8147 


o 


o 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 
23 


Q.  We're  at  the  line  I'm  pointing  to  beginning  with,  'this 
product' .  Can  you  just  tell  us  again  what  that  means? 

A.  That's  the  production  requirement  that  was  used  to  produce 
this  document,  to  authorize  the  production  of  this  document. 

Q.  And  then  how  about  that  last  line  on  there  that  says,  'ACIC 
production  or  product  identification  number' .  What  does  that  mean? 

A.  That's  the  ACIC  serial  number  for  this  product. 

Q.  Okay.  Does  that  serial  number  have  any  specific  meaning? 

A.  The  'R'  being  —  designates  ACIC.  The  '08'  is  the  fiscal 
year,  and  the  serial  number  is  the  same  as  the  one  above,  the  serial 
number.  It's  just  a  numerical  order  of  the  reports. 

Q.  Okay.  So  there's  just  assigned  - 

A.  One,  two,  three,  four,  five,  six  on  up. 

Q.  And  you  mentioned  before  that  you  have  templates  for  your 
documents? 

A.  Yes,  we  do. 

Q.  What  is  the  template  for  this  document? 

A.  The  template  for  this  document  is  the  title,  purpose, 
executive  summary,  key  judgments  background,  discussion,  conclusion 
oh,  Intel  gaps,  conclusion,  and  contact. 

Q.  Intel  gaps  and  conclusions? 

A.  And  point  of  contact. 

Q.  In  2008  that  was  the  template  you  used? 
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A.  Yes,  in  2008  that  was  the  template  we  used. 

Q.  Can  you  just  tell  us  a  little  bit  about  how  this  —  this 

self-initiated  product  was  prepared,  this  specific  product? 

A.  Mr.  Horvath  was  doing  research  and  came  across 
WikiLeaks.org  and  he  thought  it  was  a  Cl  concern. 

ADC [CPT  TOOMAN] :  Objection.  This  witness  would  have  no 

personal  knowledge  of  what  prompted  Mr.  Horvath  to  write  this 
document . 

Q.  Are  you  testifying  to  your  personal  knowledge? 

A.  Yes,  I  am,  because  I  discussed  this  with  Mr.  Horvath  during 

that  time  frame. 

ADC [CPT  TOOMAN]:  We  would  object  based  on  hearsay.  Your 

Honor. 

MJ:  What's  the  relevance,  or  are  you  introducing  it  as  hearsay 

or  not? 

ATC [CPT  OVERGAARD] :  One  moment  please,  ma'am.  Ma'am,  we'll 
stick  with  her  personal  observation  and  not  any  discussions  that  were 
had. 

MJ:  Objection,  sustained. 

Q.  Can  you  tell  us  what  specifically  was  done  to  create  this 
self-initiated  product? 

A.  The  steps? 
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Q.  Yes.  Did  —  Yes,  the  steps  that  Mr.  Horvath  took  and  the 
steps  that  you  took  in  assisting  him? 

A.  Mr.  Horvath  used  the  same  procedures  that  I  talked  about 
before . 

Q.  Okay. 

A.  I  assisted  in  some  research  and  in  reviewing  and  editing 
the  document . 

Q.  And  are  these  documents,  are  they  usually  32  pages  long? 

A.  The  documents  can  be  much  smaller,  five  pages,  or  they  can 
be  much  larger,  150  pages. 

Q.  Okay.  What's  the  average,  I  mean,  what  are  they  usually? 

A.  Average  usually  about  20  to  30  pages. 

Q.  And  let's  talk  a  little  bit  about  the  content  of  this 
actual  report.  Do  you  know  what  the  purpose  of  this  document  is? 

A.  Yes.  The  purpose  of  this  document  was  to  assess  the 
counterintelligence  threat  on  the  U.S.  Army  by  WikiLeaks.org  website. 

Q.  And  according  to  the  report  and  your  knowledge  of  the 
report,  what  is  WikiLeaks? 

A.  WikiLeaks  is  an  organization  that  exposes  illegal  activity. 

ADC [CPT  TOOMAN] :  Objection,  Your  Honor. 

MJ:  Yes. 
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1  ADC[CPT  TOOMAN] :  I  don't  believe  this  witness  is  in  a 

2  position  to  determine  the  legality  of  the  WikiLeaks'  weekly  conduct  - 

3  -  the  conduct  of  WikiLeaks. 

4  ATC [CPT  OVERGAARD] :  Ma'am,  She's  testifying  about  what  the 

5  product  actually  says. 

6  MJ:  All  right.  I'm  not  taking  her  testimony  to  be  a  legal 

7  opinion  of  whether  something  is  legal  or  illegal.  Why  don't  we  take 

8  it  to  what  purports  to  be  illegal  activity.  Go  ahead. 

9  ATC [CPT  OVERGAARD]:  Yes,  ma'am.  The  purpose  of  testimony  is 

10  only  to  elicit  what  is  actually  in  the  document  not  what  WikiLeaks  is 

11  or  is  not,  but  what  is  written  in  the  document. 

12  MJ:  Go  ahead. 

13  Questions  continued  by  the  assistant  trial  counsel  [CPT  OVERGAARD] : 

14  Q.  So,  can  you  tell  us  what  WikiLeaks  is  according  to  this 

15  report? 

16  A.  Okay.  I  would  —  According  to  the  report,  it  says,  'That 

17  the  intent  of  WikiLeaks  website  is  to  expose  unethical  practices, 

18  illegal  behavior,  and  wrongdoing  within  corrupt  corporations  and 

19  governments'  . 

20  Q.  And  does  the  report  comment  on  whether  or  not  WikiLeaks  is 

21  a  news  organization? 

22  A.  Yes,  it  does. 

23  Q.  And  what  does  it  say? 
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A.  It  says  that,  'WikiLeaks.org  is  not  considered  a  news 
organization' . 

Q.  And  does  it  give  some  reasons  for  that? 

A.  Yes,  it  does.  It  says  that,  'WikiLeaks  does  not  vet  their 
sources.  WikiLeaks  does  not  provide  overview.  WikiLeaks  does  not 
provide  source  checking  or  facts  checking,  and  WikiLeaks  does  not 
provide  —  WikiLeaks  does  not  confirm  the  accuracy  of  the 
information' . 

Q.  Does  it  talk  about  how  WikiLeaks  releases  information? 

A.  Yes,  it  does. 

Q.  What  does  it  say  about  that? 

A.  It  says,  'WikiLeaks.org  uses  anonymous  methods  to  post  the 
information  to  the  sites'.  So,  let  me  find  it  in  here.  It  says, 
'WikiLeaks.org  uses  its  own  coded  and  software  combined  with 
WikiMedia,  WikiOpen,  as  a  self-free  net  tour,  and  PDC  to  make  it 
difficult  for  foreign  governments,  FIS,  law  enforcement  agencies,  and 
foreign  businesses  to  determine  where  a  leak  document  originated  from 
and  who  was  responsible  for  leaking  the  document' . 

Q.  Can  you  tell  us  what  page  you're  looking  at? 

A.  I'm  looking  at  Page  5. 

Q.  What  paragraph  was  that? 

A.  Paragraph  3. 
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Q.  Does  it  talk  about  —  Does  this  product  further  talk  about 
what  type  of  behavior,  this  anonymous  releasing  encourages? 

A.  Yes.  The  document  says  that,  'the  anonymous  behavior 
encourages,'  let  me  get  the  exact  words.  It  says  that,  'the 
WikiLeaks.org  is  knowingly  encouraging  criminal  activities  such  as 
the  theft  of  data,  documents,  proprietary  information  and 
intellectual  property.  Possible  violations  of  national  security  laws 
regarding,  sedition  and  espionage  and  possible  violation  of  civil 
laws  within  the  United  States  and  foreign  countries.  They  allege 
that  whistle  blowers  are  in  effect  willingly  violating  laws  and 
conditions  of  employment  and  thus  may  not  qualify  as  whistle  blowers 
protected  from  the  disciplinary  action  or  retaliation  from  reporting 
wrongdoing  in  countries  that  have  such  laws.'  Page  20. 

Q.  Okay.  What  paragraph  on  Page  20  were  you  looking  at? 

A.  Page  20,  Paragraph  1. 

Q.  That  one  or  that  one? 

A.  That  one. 

Q.  Okay.  The  top  paragraph,  the  half  paragraph? 

A.  Page  19  it  starts. 

Q.  Okay.  According  to  this  what  threat  does  WikiLeaks  pose? 

A.  WikiLeaks  propo  —  WikiLeaks  propose  a  force  protection 
Cyber  Counter  --  Cyber  Intelligence,  excuse  me,  not  Cyber  Intel  -- 
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force  protection,  counterintelligence,  information  security,  and 
operation  security  threat. 

Q.  And  is  that  —  That's  in  the  key  judgments? 

A.  Yes,  it  is. 

Q.  And  what  else  or  what  does  the  key  judgment  say  about  how 
it  does  this,  how  WikiLeaks  does  this?  Just  looking  at  key  judgments 
on  Page  3? 

A.  Okay.  It  says,  'Recent  unauthorized  release  of  DoD  and 
sensitive  and  classified  information  provided,  FIS,  foreign 
terrorists  groups  and  insurgents  and  other  foreign  adversaries  with 
potentially  actionable  information  for  targeting  U.S.  forces'. 

Q.  Does  the  report  discuss  any  examples  of  information  that 
are  posted  on  WikiLeaks? 

A.  Yes.  This  report  has  three  examples. 

Q.  What  were  those  three  examples? 

A.  The  first  example  was  the  release  of  tables  of  equipment 
for  troops  deployed  in  Iraq  and  Afghanistan.  The  second  example  was 
release  of  a  standard  operation  procedures  for  Joint  Task  Force 
Guantanamo.  The  third  example  was  a  classified  document  released 
that  is  produced  by  National  Ground  Intelligence  Center. 

Q.  What  information  in  particular  according  to  this  report  was 
in  the  TO&E,  the  tables  of  equipment  that  you  just  mentioned? 

A.  The  Report. 
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Q.  Just  in  general  what  is  in  —  What  was  in  the  TO&Es? 

A.  The  TO&E  had  a  list  of  all  equipments  --  all  equipment  that 
was  deployed  in  Afghanistan  and  in  Iraq. 

Q.  And  did  the  products  say  anything  about  the  dangers  of 
releasing  that  information? 

A.  Yes.  It  said  that  the  products  stated  that,  'the  release 
of  that  information  could  allow  foreign  intelligence  service 
terrorist  groups,  Iraqi  insurgents  to  conduct  attacks  against  U.S. 
Army  forces  in 

ADC[CPT  TOOMAN] :  Objection.  Relevance,  Your  Honor. 

MJ:  What  is  the  relevance? 

ATC[CPT  OVERGAARD] :  Ma'am,  it's  relevant  to  the  accused's 
knowledge . 

MJ:  All  right.  Overruled. 

Q.  All  right.  You  can  continue.  Sorry. 

A.  The  identification  of  vehicles,  military  vehicles,  could  be 
used  to  select  specific  types  and  emplacements  of  improvised 
explosive  devices. 

Q.  And  then  you  also  mentioned  that  there  was  an  NGIC  report, 
a  National  Ground  Intelligence  Report? 

A.  Yes,  there  is. 

Q.  What  did  that  contain? 
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A.  That  report  discussed  asymmetrical  warfare,  tactic, 
techniques,  and  procedures  used  against  U.S. 

Q.  And  what  was  —  What  was  the  classification  of  that 
document? 

A.  That  document  was  classified  Secret  NOFORN . 

Q.  And  that  was  also  released  by  WikiLeaks? 

A.  Yes,  it  was. 

Q.  And  according  to  the  product  what  could  be  the  impact  to 

the  United  States  if  that  were  released? 

A.  The  impact  would  be  insight  into  a  successful  asymmetric 
warfare  tactic,  techniques  and  procedures,  operation  against  U.S. 
forces  and  coalition  forces. 

Q.  And  is  this  an  intelligence  product? 

A.  Yes,  it  is. 

Q.  And  why  is  it  an  intelligence  product? 

A.  Because  it  contains  intelligence  documents  within  it. 

Q.  Do  other  U.S.  government  entities  rely  on  these 
intelligence  products? 

A.  Yes,  they  do. 

Q.  And  was  this  product  in  particular  used  by  other  U.S. 
government  entities? 

A.  Yes,  they  were. 

Q.  How  do  you  know  that? 
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A.  Because  people  have  discussed  it,  feedback. 

Q.  Was  this  product  ever  released  outside  of  SIPRNET? 

A.  No,  it  wasn't. 

MJ:  When  you  are  saying,  this  product,  are  you  talking  about 

the  NGIC  report  or  are  you  talking  about  the  ACIC  report? 

ATC[CPT  OVERGAARD] :  I'm  sorry,  ma'am.  I'm  talking  about  this 
report  --  the  ACIC  report. 

Q.  Was  this  —  Was  the  2008  version  that  you're  familiar  with 
of  the  ACIC  report  ever  released  outside  of  SIPRNET? 

A.  To  my  knowledge  it  was  only  posted  on  SIPRNET  and  JWICS  and 
never  released  out  of  those  two  sites. 

Q.  Was  it  ever  unofficially  released? 

A.  To  my  knowledge,  no,  it  wasn't. 

Q.  You're  not  familiar  with  this  document  being  unofficially 
released  anywhere  else? 

A.  Unofficially  released? 

Q.  Not  officially,  unofficially  so  - 

A.  Oh,  okay.  I'm  sorry.  I  thought  you  said  —  To  my 
knowledge,  this  document  was  never  unofficially  released. 

Q.  So - 

A.  I  mean  never  officially  released.  I'm  sorry. 

Q.  Okay.  Was  it  unofficially  released  though? 

A.  Yes.  You've  got  me  confused  here? 
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Q.  Do  you  know  if  this  document  was  ever  released? 

A.  No.  To  my  knowledge,  the  document  was  never  released. 

Q.  Even  unofficially. 

A.  To  my  knowledge,  this  document  was  never  un  —  officially 
released? 

Q.  Okay.  Can  you  tell  us  —  can  you  tell  us,  according  to  the 
conclusion  of  this  document,  what  must  be  presumed  about  adversary  — 
yes,  adversary  access  to  WikiLeaks?  I'm  just  looking  at  Page  21. 

A.  'It  must  be  presumed  that  WikiLeaks  organization  have  or 
will  receive  sensitive  or  classified  documents  in  the  future.  It 
must  also  be  presumed  that  foreign  adversaries  will  review  and  assess 
any  DoD  or  classified  information  posted  on  the  WikiLeaks.org 
website' . 

Q.  Thank  you.  Was  this  document  ever  posted  on  WikiLeaks? 

A.  Yes,  it  was. 

Q.  And  how  do  you  know  that? 

A.  Because  I  was  informed  by  an  individual  who  saw  on  it 
WikiLeaks . 

ADC [CPT  T00MAN] :  Objection? 

MJ:  Okay. 

Q.  Do  you  have  firsthand  knowledge? 

MJ:  Sustained. 

ATC [CPT  OVERGAARD] :  Sorry,  ma'am. 
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Q.  Do  you  have  firsthand  knowledge  of  that? 

A.  Yes,  I  do. 

Q.  And  what  is  your  firsthand  knowledge  of  that? 

A.  I  received  a  phone  call  from 
MJ:  Sustained. 

Q.  Did  you  see  the  product? 

A.  It  was  e-mailed  to  me. 

Q.  Okay.  And  it  was  from  WikiLeaks? 

A.  It  was  e-mailed  to  me  from  somebody  who  took  it  off  of  the 
WikiLeaks . 

Q.  And  how  do  you  know  that?  What  did  it  look  like? 

A.  It  looked  like  the  exact  same  document  that  was  posted  to 

our  website. 

Q.  Did  it  have  anything  —  any  particular  identifying  marks  on 
it  that  made  you  that  think  it  was  from  WikiLeaks? 

A.  No,  not  the  document  that  I  received. 

Q.  Okay. 

A.  But  I  received  it  on  an  unclassified  system. 

Q.  Okay.  Thank  you. 

MJ:  Cross? 

ADC [CPT  TOOMAN] :  Yes,  ma'am. 
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CROSS-EXAMINATION 

Questions  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

Q.  Good  evening,  Ms.  Glenn. 

A.  Good  evening. 

Q.  I'm  going  to  retrieve  that  exhibit  from  you.  Prosecution 
Exhibit  45.  Thank  you. 

ADC [CPT  TOOMAN]:  Ma'am,  I'm  going  to  publish  this. 

MJ:  Go  ahead. 

ADC [CPT  TOOMAN]:  I'm  now  publishing  Page  1  of  Prosecution 

Exhibit  45. 

Q.  Ms.  Glenn,  my  first  question  for  your  is:  You  talked  on 
direct  about  the  title  of  this  document,  correct? 

A.  Yes. 

Q.  And  you  read  it  to  the  Court.  Would  you  agree  that  the 
title  of  this  document  actually  has  a  question  mark  at  the  end? 

A.  Yes,  it  does. 

Q.  Okay.  And  so  that  would  suggest,  would  you  agree,  that  we 
don't  know  the  answer  to  that  question  or  this  document  is  going  to 
set  out  to  answer  that  question?  Would  you  agree  with  that? 

A.  Could  you  repeat  the  question? 

Q.  Sure.  You  would  agree  that  based  on  the  title,  this 
document,  that  is  a  question,  that  is  we  don't  know  whether  foreign 
intelligence  services,  insurgents,  or  terrorist  groups  use  WikiLeaks 
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as  an  on-line  reference.  Would  you  agree  with  that?  The  question 
mark  would  suggest  that  we  don't  know.  Do  you  agree  with  that? 

A.  The  question  mark  suggest  that  we  can't  confirm  it. 

Q.  Okay.  And  so  - 

A.  Not  that  we  don't  know,  but  we  can't  confirm  it. 

Q.  Okay.  We  can  confirm  it.  Okay.  If  we  could  confirm  it 
there  wouldn't  be  a  question  mark  there,  correct? 

A.  At  that  time,  yes. 

Q.  I'm  sorry?  So  if  there  were  no  question  mark  there  you 
would  agree  with  me  that  that  would  suggest  that  foreign  intelligence 
service,  insurgents,  and  terrorist  groups  are  using  WikiLeaks  as  an 
on-line  reference? 

A.  During  that  timeframe  we  couldn't  confirm  it. 

Q.  Okay.  Now  I'm  going  to  remove  Page  1  from  the  overhead  and 
place  Page  2.  You  talked  on  direct  about  the  stated  purpose  of 
WikiLeaks,  and  I  would  direct  your  attention  to  the  second  paragraph 
from  the  bottom  which  is  the  one  denoted  by  the  'U'  the  unclassified 
paragraphs  there.  Do  you  see  that? 

A.  Yes. 

Q.  You  would  agree  with  me  that  the  stated  intent  of  WikiLeaks 
is  to  expose  unethical  practices,  illegal  behavior,  and  wrongdoing 
within  corrupt  organizations  or  corporations,  and  oppressive  regimes 
throughout  the  world.  Is  that  accurate? 
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A.  That  was  the  stated  intent. 

Q.  Okay.  It  doesn't  —  The  stated  intent  is  to  not  to  assist 
foreign  militaries,  correct? 

A.  I  can't  make  that  determination. 

Q.  Okay.  Well,  that  wasn't  stated,  you  would  agree  with  that, 
correct? 

A.  That's  not  stated  within  the  document,  yes. 

Q.  Okay.  Now,  continuing  to  talk  and  I've  removed  Page  2  from 
the  overhead.  I'm  going  now  to  place  Page  6  on.  Continuing  to  talk 
about  the  stated  purpose  of  WikiLeaks.  I  want  to  direct  your 
attention  to  the  first  full  paragraph  there,  the  one  with  the  'U'  in 
parenthesis,  starts  'WikiLeaks.org'.  Go  ahead  and  read  that  first  — 
first  paragraph  there  for  me.  I'll  point  to  that  paragraph  here  with 
my  pen. 

A.  'WikiLeaks.org'  - 

Q.  Just  read  it  to  yourself,  ma'am,  I'm  sorry? 

A.  Oh,  okay.  [The  witness  reviewed  the  portion  of  the  exhibit 

as  directed.]  Okay. 

Q.  Ma'am,  based  on  this  report  would  you  agree  with  me  that 
one  of  the  purposes  or  the  goals  of  WikiLeaks  is  a  free  and 
unrestrained  press?  Would  you  agree  with  that  ma'am? 

A.  Based  on  this  statement,  yes. 
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Q.  Removing  Page  6.  Ma'am,  I'd  like  to  talk  now  a  little  bit 
about  how  these  documents  are  created.  Okay?  Now,  you  talked  about 
a  few  different  ways  in  which  one  of  these  products  could  be 
initiated.  You  talked  about  it  could  be  self-initiated,  correct,  and 
that's  what  happened  in  this  case? 


A. 

Uh,  huh  [indicating  an  affirmative  response] . 

Q. 

I'll  just  ask  you  to  say  your  answer  out  loud  for  the 

purpose  of  the  court  reporter 


A. 

Yes. 

Q. 

Okay.  Thank  you.  Another  way  would  be  through  an  RFI, 

correct? 


A. 

Request  for  information,  yes. 

Q. 

Okay.  Could  you  explain  what  this  is,  please? 

A. 

That's  when  a  command  sends  us  through  e-mail  or  a  request 

for  information  on  a  particular  item  and  then  we  would  research  it 
and  produce  a  product  off  of  it. 


Q. 

So  if  there  were  requests  for  information,  and  there  wasn't 

a  request 

for  information  in  this  case,  correct? 

A. 

No,  this  is  self-initiated. 

Q. 

So  no  unit  came  to  ACIC  and  said,  hey,  we  think  that  maybe 

WikiLeaks 

is  using,  or  the  enemy  is  using  WikiLeaks,  we'd  like  you  to 

look  into 

it,  correct,  that  didn't  happen? 

A. 

No.  No  request  for  information. 
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Q.  Okay.  And  you  mentioned  a  third  way  in  which  one  of  these 
documents  would  be  initiated.  What  was  that,  ma'am? 

A.  A  requirements. 

Q.  Okay.  And  could  you  explain  what  that  means? 

A.  That's  through  our  production  system.  A  customer  will  put 
in  a  request  for  assessment  and  then  we  will  perform  that  assessment 
based  on  their  request. 

Q.  So  if  someone  had  said,  hey,  we  think  that  maybe  WikiLeaks 
is  getting  used  by  the  enemy,  they  could  have  used  that  process  in 
order  to  have  this  product  produced.  Is  that  correct? 

A.  Yes,  they  could  have. 

Q.  Okay.  And  that  didn't  happen  here,  correct? 

A.  No,  it  didn't. 

Q.  Okay.  Now,  I'd  liked  to  speak  now  about  sort  of  the 
process  through  which  this  is  created.  Once  it's  been  initiated  here 
we  had  self-initiation  and  then  you  talked  about  all  the  research 
that  goes  into  it,  right? 

A.  Yes. 

Q.  And  I  think  you  talked  about  in  this  case  it  would  be  Mr. 
Horvath  or  whoever  drafted  the  document  would  have  looked  at  JWICS . 

Is  that  correct? 

A.  Yes. 
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Q.  So  Mr.  Horvath  would  have  looked  at  JWICS  and  he  would  have 
been  looking  for  any  sort  of  intelligence  that  would  have  helped 
answer  the  question  posed  by  this  paper? 

A.  He  would  use  that,  but  that  wouldn't  be  the  only  source 
that  he  would  use. 

Q.  Sure,  okay.  Within  JWICS,  you  would  agree  that  JWICS  is 
where  the  United  States  Government  keeps  Top  Secret  information, 
correct? 

A.  There's  other  information  on  JWICS.  It's  not  only  Top 
Secret . 


Q.  Sure,  thank  you.  So,  you  would  have  not  only  Top  Secret 
information  on  JWICS,  but  other  information  as  well? 

A.  Yes. 

Q.  There's  a  lot  of  information  on  JWICS? 

A.  Yes. 

Q.  You've  got  the  SIPRNET  and  that  includes  Secret  and  down, 

correct?  And  then  JWICS  is  higher.  So  there's  even  more  on  JWICS? 

A.  Yes. 

Q.  Okay.  And  you  talked  about  a  number  of  INTs  that  would 
have  been  referenced  when  producing  this  document? 

A.  Yes. 

Q.  There  was  HUMINT? 

A.  Yes. 
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Q.  SIGINT? 

A.  Yes. 

Q.  OSINT? 

A.  Yes. 

Q.  MASINT? 

A.  Yes. 

Q.  Did  I  miss  any? 

A.  IMINT. 

Q.  IMINT,  okay.  So  all  of  those  INTS  would  have  been  looked 
at  by  the  individual  who  drafted  this  document? 

A.  Yes. 

Q.  Pretty  much  the  author  of  this  document  had  just  about  all 
of  the  United  States  Government's  intelligence  at  their  fingertips. 

Is  that  fair  to  say,  with  some  very  limited  exceptions,  they  were 
looking  at  just  about  everything? 

A.  Yes.  They  was  [sic]  looking  at  just  about  everything,  yes. 

Q.  Now,  so  the  individual  who  drafted  the  document  would  have 
looked  at  all  of  this  information  and  they  incorporated  that  into 
their  document? 

A.  If  they  found  something. 

Q.  Sure.  If  they  found  something,  if  they  found  a  source  they 
would  have  noted  it  in  this  document  and  then  after  the  document  was 
written  it  would  have  gone  out  for  external  coordination,  correct? 
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1  A. 

Yes . 

2  Q. 

Okay.  And  in  this  case  Mr.  Horvath  looked  at  all  of  this 

3  information,  all  of  JWICS,  all  the  INTS  and  then  he  sent  it  out  to 

4  the  National  Ground  Intelligence  Center,  correct? 


5  A. 

Yes. 

6  Q. 

And  they  scrubbed  it  as  well? 

7  A. 

Yes . 

8  Q. 

And  so  if  they  would  have  had  any  intelligence  that  maybe 

9  Mr.  Horvath  missed  or  maybe  didn't  have  access  to  they  could  have 


10  added  it 

on  this  document,  correct? 

11  A. 

Yes . 

12  Q. 

And  so  this  external  coordination  is  a  process  through 

13  which  we  can  make  sure  we  have  as  much  intelligence  as  possible  in 

14  forming  this  paper,  correct? 


15  A. 

Yes . 

16  Q. 

Now,  I  want  to  talk  about  the  document  itself.  Through  the 

17  document 

there  are  footnotes,  correct? 

18  A. 

There  are  end  notes. 

19  Q. 

End  notes,  okay,  I'm  sorry.  End  notes.  And  what  is  the 

20  purpose  of  an  end  note? 

21  A.  The  purpose  of  the  end  note  is  to  list  where  you  acquired 

22  the  information  from. 

23  Q.  So  it's  the  source,  is  that  accurate? 
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A.  Yes,  it's  the  source. 

Q.  So  if  there  was  an  intelligence  report  that  said  Captain 
Tooman  eats  too  many  cookies.  There  would  be  an  end  note  and  then 
someone  would  have  —  you'd  have  the  source  of  that  information? 

A.  Yes. 

Q  And  it  might  be  my  mother  or  someone  else,  right? 

A.  Yes. 

Q.  That's  how  an  end  note  would  work? 

A.  Yes. 

Q.  Now,  I  want  to  --  I'm  going  to  publish  Page  11.  I'll 
direct  your  attention  to  sort  of  the  middle  of  the  paragraph  here  we 
have  a  paragraph  that  was  Secret  NOFORN,  it's  been  lined  through.  It 
starts,  'Intelligence  indicates  that  insurgents' .  Right  here.  Do 
you  see  that? 

A.  Yes. 

Q.  That  says  intelligence  indicates  that  insurgents  in 
Afghanistan  have  recovered  several  Warlock  systems  and  then  we  have 
an  end  note.  And  we  have  the  unclassified  version  of  this  document, 
but  if  we  were  looking  at  the  classified  version  we  can  go  to  Number 
22  the  at  the  back  and  we  can  see  the  source  of  that  information, 
correct? 

A.  Yes. 
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Q.  And  we  would  know  from  looking  at  that  classified  document, 
how  we  know  that  insurgents  in  Afghanistan  have  recovered  several 
Warlock  systems? 

A.  Yes. 

Q.  That  would  be  some  intelligence  that  was  gathered  from  the 
JWICS  system  or  from  some  other  source  that  the  author  referenced? 

A.  Yes. 

Q.  Or  it  could  have  been  something  that  the  external 
coordination  added  to  the  document  as  well,  correct? 

A.  Yes. 

Q.  Okay.  I'm  going  to  remove  Page  11.  Now,  would  you  agree 
with  me  that  this  document,  there  are  over  50  end  notes? 

A.  I'm  not  exactly  sure  how  many  end  notes  was  in  the 
document.  I  can't  remember. 

Q.  Okay.  I'm  going  to  hand  the  witness  what's  been  marked  as 
Prosecution  Exhibit  45.  If  you  would  please,  ma'am,  just  take  a  look 
at  that  and  just  let  us  know  how  many  end  notes  there  are? 

A.  Fifty-five  end  notes. 

Q.  I'm  going  to  retrieve  the  exhibit  from  the  witness.  So 
within  this  document  there  are  facts  or  pieces  of  intelligence  that 
we  --  the  government  had  verified?  That's  how  we  know  it,  correct? 

A.  There's  55  pieces  of  information  of  end  notes  that  list 

sources . 
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Q.  Would  you  agree  with  me  that  if  we  had  a  source  for 
something  it  would  be  listed? 

A.  If  there  was  a  source  for  something  in  that  document,  if 
the  analyst  found  it,  it  would  be  listed;  but  that  does  not  mean  that 
the  analyst  did  not  find  all  the  sources. 

Q.  Okay. 

MJ:  Wait  a  minute.  That  does  not  mean  that  the  analyst  did  not 

find  all  the  sources?  I  don't  understand  that. 

WIT:  Okay.  So  let's  say  an  analyst  is  writing  product  and  some 
sources  have  not  been  published  yet.  So,  therefore,  that  analyst 
when  he  wrote  that  product  would  not  have  all  of  the  sources  for  that 
document,  but  he  will  write  the  documents  based  on  the  sources  that 
he  has  available. 

Q.  So  there  might  be  some  intelligence  out  there  that  he  just 
hasn't  seen  yet? 

A.  Yes. 

Q.  Okay.  And  he  wouldn't  —  he  wouldn't  obviously  incorporate 
that  into  the  document? 

A.  No,  because  he  has  not  seen  it? 

Q.  It  would  be  impossible  to  incorporate  it? 

A.  Yes. 

Q.  Okay.  Thank  you.  Now,  ma'am,  I'm  going  to  publish  Page  20 
and  I'd  like  to  focus  on  the  one  of  the  areas  in  the  template  called 
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intelligence  gaps.  Ma'am,  you  would  agree  with  me  that  an 
intelligence  gap  is  something  that  we  don't  know,  correct? 

A.  Not  always. 

Q.  Not  always,  okay.  You  would  agree  with  me  that  it's 
something  that  we  —  a  gap  is  there's  something  missing,  correct? 

A.  Not  always. 

Q.  What  is  a  gap? 

A.  Sometimes  a  gap  could  be  information  that  we  cannot 
confirm. 


Q.  Okay. 

A.  We  know  it,  but  we  can't  confirm  that  it's  actually  true. 

Q.  Okay.  And  you  would  agree  with  me  that  in  cases  where  you 
know  something  you  would  cite  it,  correct,  you  would  cite  a  source 
for  it?  If  you  know  it  you  cite  the  source  for  it,  correct? 

A.  If  the  source  can  confirm  it  —  we  can  know  something  but 
we  can't  confirm  it.  So  we  cannot  put  it  in  the  document  because 
it's  not  —  it's  not  corroborated. 

Q.  When  you  say  you  can't  confirm  it,  you  mean  you  don't 
really  know,  you  can't  say  for  sure  that  you  know  this? 

A.  I  can't  say  for  sure  that  I  know  it. 

Q.  Okay,  and  if  you  had  even  any  sort  of  source  or 
intelligence  you  would  have  --  would  you  cite  that  in  the  document. 
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correct?  You  wouldn't  have  a  source  for  something  and  then  just 
leave  that  source  out,  right? 

A.  If  I  can't  confirm  the  source,  yes,  I  would  leave  it  out. 

Q.  Because  you  can't  confirm  it? 

A.  That's  correct. 

Q.  You  don't  know  for  sure? 

A.  Not  necessarily  that  I  don't  know  for  sure.  I  cannot  not 
confirm  the  source  is  accurate. 

Q.  Okay.  Well,  if  you  knew  for  sure,  you  would  put  the  source 
in  there,  right? 

A.  If  the  source  is  verified,  yes,  I  would  put  the  information 
in  there. 

Q.  Okay.  Now,  I  want  to  talk  about  these  intelligence  gaps. 
I'd  like  to  direct  your  attention  to  the  third  one.  You'd  agree  with 
me  that  this  says,  'Would  the  WikiLeaks.org  website  be  used  by  FISS' , 
that's  Foreign  Intelligence  Services.  Is  that  correct? 

A.  Yes. 

Q.  Foreign  military  services,  foreign  insurgents,  or 
terrorists  groups  to  collect  sensitive  or  classified  or  U.S.  Army 
information  posted  to  the  WikiLeaks.org  website.  That's  listed  as  an 
intelligence  gap,  correct? 

A.  Yes. 

Q.  So  that's  something  you  can't  confirm? 
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A.  No,  we  can't  confirm  that. 

Q.  And  would  you  agree  with  me  that  there  is  no  end  note  at 
the  end  of  that  intelligence  gap,  correct? 

A.  Intelligence  gaps  we  don't  put  end  notes  on  intelligence 

gaps. 

Q.  Because  you  don't  have  sources  for  them? 

A.  They're  gaps. 

Q.  There  is  not  an  end  note,  but  there  is  a  question  mark, 
correct? 

A.  Yes,  there  is. 

Q.  Again,  a  question  mark  would  indicate  that  it's  something 
that  we  are  looking  for  the  answer  to,  right? 

A.  Something  we  can't  confirm  the  answer  to. 

Q.  Okay.  If  we  had  the  answer,  it  wouldn't  be  in  the 
intelligence  gap  section,  correct? 

A.  If  we  can't  confirm  it  then  we  put  it  in  the  intelligence 

gaps . 

ADC [CPT  TOOMAN] :  Your  Honor,  I  have  no  further  questions. 

I'm  going  to  remove  Page  20  of  Prosecution  Exhibit  45  and  return  that 
to  the  court  reporter.  Thank  you,  ma'am. 

MJ:  Redirect? 

ATC [CPT  OVERGAARD] :  Yes,  ma'am,  just  one  moment,  please. 
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REDIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  OVERGAARD] : 

Q.  Hi,  Mrs.  Glenn.  So  you  started  explaining  about 
intelligence  gaps  a  little  bit  when  defense  asked  you  about  it,  but  I 
want  to  hear  in  your  own  words  what  is  an  intelligence  gap? 

A.  That  is  easier  if  I  give  you  an  example. 

Q.  Okay. 

A.  Let's  say  I  look  at  an  organization.  I  know  the 
organization  name.  I  know  that  organization  has  five  branches.  I 
know  four  of  the  branch  names,  but  the  fifth  branch  I'm  not  exactly 
sure  what  the  name  is.  I  have  an  idea  of  what  it  could  possibly  be 
based  on  their  structure,  but  I  cannot  confirm  if  that's  the  actual 
name.  That's  an  example,  one  example  of  an  intel  gap. 

Q.  Okay.  Well,  how  about  --  how  about  using  the  example  that 
defense  pointed  out.  What  can  be  confirmed,  or  can  you  explain  why 
that's  an  intelligence  gap,  what's  confirmed  and  what  needs 
verification?  How  does  that  work? 

A.  In  this  particular  example  we  know  that  intelligence 
organization  and  terrorist  groups  perform  open  source  collection, 
but  we  cannot  confirm  if  they  actually  visit  that  site  and  looked  at 
the  information. 

ATC [CPT  OVERGAARD]:  Just  one  moment,  please. 
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1  [There  was  a  brief  pause  while  the  assistant  trial  counsel  consulted 

2  with  the  trial  counsel . ] 

3  Q.  And  then  after  the  intelligence  gaps,  again,  what  does  the 

4  conclusion  say  starting  with  'in  addition'? 

5  A.  It  says,  'in  addition,  it  must  also  be  presumed  that 

6  foreign  intelligence'  —  'foreign  adversaries  will  review  and  assess 

7  any  DoD  sensitive  or  classified  information  posted  to  the 

8  WikiLeaks.org  website'. 

9  ATC  [CPT  OVERGAARD] :  Thank  you. 

10  MJ:  And  you  are  standing  up  because  you  want  a  final  recross? 

11  ADC [CPT  TOOMAN] :  Yes,  ma’am. 

12  MJ:  All  right.  And  I  will  give  the  government  redirect  there 

13  too.  Go  ahead. 

14  ADC [CPT  TOOMAN]:  Thank  you.  Your  Honor. 

15  RECROSS-EXAMINATION 

16  Questions  by  the  assistant  defense  counsel  [CPT  TOOMAN] : 

17  Q.  Now,  ma'am,  you  said  that  an  intelligence  gap  would  be 

18  something  that  we  can’t  confirm.  You  would  agree  that  an 

19  intelligence  gap  would  —  could  also  be  something  we  have  no  idea 

20  about? 


21 

A. 

It 

could 

be . 

22 

Q. 

It 

could 

be. 

Okay. 

And  you  talked  just  now  about 

23  presuming  something.  How  do  you  define  presume,  ma’am? 
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A.  How  do  I  define  presume? 

Q.  Uh,  huh  [indicating  an  affirmative  response] . 

A.  That  quote  was  based  on  historical  analysis  of  what  foreign 
intelligence  services  and  terrorist  organizations  do.  So,  we  know 
they  conduct  open  source  intelligence  and  we  know  that  they  are 
interested  in  classified  and  sensitive  U.S.  Government  information. 

So  based  on  what  we  know  they  do,  we  presume  that  they  will  visit 
that  site  if  that  information  is  posted  there. 

Q.  But  you  have  no  intelligence  that  the  enemy  or  those  groups 
have  ever  gone  to  WikiLeaks.org? 

A.  At  that  time  —  during  that  timeframe  we  could  not  confirm 
it. 

Q.  And  you  also  couldn't  say  if  they  were  going  to  go  there  in 
the  future? 

A.  We  know  that  they  do  open  source  research.  We  know  they 
have  certain  key  words  they  use  to  search  with,  and  we  know  if  this 
classified  or  sensitive  government  information,  that  information  will 
be  reviewed  and  assessed. 

Q.  And  you  presume  that?  You  - 

A.  We  know  that  they  visit  websites. 

Q.  You  know  they  visit  websites  - 

A.  And  collect  information. 

Q.  -  but  you  don't  know  they  visit  WikiLeaks? 
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1  A.  We  cannot  confirm  that  they  didn't  visit  WikiLeaks. 

2  Q.  You  have  no  intelligence  that  suggests  that  they  have  ever 

3  been  to  WikiLeaks  at  that  time? 

4  A.  We  couldn't  confirm  it  at  that  time  that  they  visited 

5  WikiLeaks. 

6  Q.  And  if  you  would,  ma'am,  please,  you've  explained  that 

7  conclusion,  but  what  does  just  the  word  presume,  what  does  that  mean 

8  to  you,  ma'am? 

9  A.  Presume? 

10  Q.  Presume. 

11  A.  Presume  to  me  means  that  we  will  —  presume  means  that  we 

12  think  that  they  will  visit  that  website. 

13  ADC [CPT  TOOMAN] :  Okay.  Thank  you,  ma'am. 

14  MJ:  Any  final  redirect? 

15  ATC [CPT  OVERGAARD] :  Yes,  ma'am. 

16  M J:  And  this  is  final. 

17  ATC  [CPT  OVERGAARD]:  Re-re-redirect ,  yes,  ma'am,  thank  you. 

18  REDIRECT  EXAMINATION 

19  Q.  All  right.  You  said  on  cross  you  could  not  confirm  enemies 

20  saw  WikiLeaks  in  2008? 

21  A.  In  2008  we  could  not. 

22  Q.  How  about  in  2009? 

23  A.  In  2009,  we  could  not. 
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1  Q.  And  how  about  in  2010? 

2  A.  In  2010,  we  could. 

3  ATC [CPT  OVERGAARD] :  Thank  you. 

4  MJ:  I  just  have  one  question  for  you  too. 

5  WIT:  Yes,  ma'am. 

6  EXAMINATION  BY  THE  COURT-MARTIAL 

7  Questions  by  the  military  judge: 

8  Q.  You  talked  about  the  three  different  ways  that  reports  are 

9  generated. 

10  A.  Yes. 

11  Q.  The  self-initiate  have  had  versus  the  RFI  versus  the,  I 

12  forgot  what  you  called  it. 

13  A.  Induction  requirement. 

14  Q.  Okay.  In  terms  of  frequency,  how  frequently  are  self- 

15  initiated  reports  generated  versus  the  other  two?  Are  they  unusual? 

16  A.  No,  they're  not.  They're  common.  Self-initiated  —  based 

17  on  our  mission  statement  we  identify,  you  know,  threats  to  the  United 

18  States  Army  counterintelligence  threats  to  the  United  States  Army. 

19  So  we  are  always  looking  for  threats  to  the  United  States  Army.  So 

20  self-initiate  the  products  are  produced  often  within  our 

21  organization. 

22  MJ:  Any  follow-up  questions  based  on  mine? 

23  ATC [CPT  OVERGAARD]:  No,  ma'am. 
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ADC [CPT  TOOMAN] :  No,  ma'am. 

MJ:  Temporary  or  permanent  excusal? 

ATC [CPT  OVERGAARD] :  Temporary,  ma'am. 

[The  witness  was  temporarily  excused,  duly  warned,  and  withdrew  from 
the  courtroom . ] 

MJ:  Is  there  any  further  evidence  either  side  want  to  put  on 

the  today? 

TC [MAJ  FEIN]:  No,  ma'am. 

MJ:  All  right.  Before  we  —  oh,  yes? 

CDC [MR.  COOMBS]:  No,  Your  Honor. 

MJ:  Before  we  recess  the  Court  I  do  want  to  go  over  a  timeline 

for  deciding  today's  issues  on  objections  for  Prosecution  Exhibits 
31,  32,  and  109.  I  would  like  the  parties  to  put  in  writing. 
Government,  what's  the  relevance  of  these  what  hearsay,  non-hearsay 
purpose.  Defense,  I  mean,  we  sort  of  put  the  issue  —  we've  teed  the 
issue  up  if  you  will,  on  the  table.  I'm  not  going  to  have  the 
government  file  first  and  then  you  file  next.  I  think  you  have  the 
gist  of  what  they're  bringing  in.  You  can  have  an  oral  argument  if 
they  create  something  knew,  then  we  can  address  it  there. 

I  understand  we've  had  a  busy  week  and  you  all  are  bringing 
in  witnesses  and  doing  that.  If  we  take  a  little  bit  of  time  to  file 
these  briefs  and  for  me  to  rule,  are  these  exhibits  going  to  be 
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introduced  with  any  other  witnesses  that  are  coming  in  tomorrow  or 
the  next  day? 

ATC [CPT  MORROW]:  No,  Your  Honor. 

MJ:  All  right.  So,  what's  the  window  of  time  then  that  we're 

looking  at  before  we  have  to  have  that  issue  resolved? 

ATC [CPT  MORROW]:  I  believe  the  end  of  the  week,  you  know,  is 
probably  sufficient  to  get  this  resolved. 

MJ:  Okay.  What  is  a  reasonable  timeline  in  light  of  your 

schedules  with  witnesses  and  preparation  and  getting  everybody  here 
without  delaying  the  proceedings  to  be  able  to  come  up  with  these 
filings? 

TC [MAJ  FEIN]:  Your  Honor,  the  United  States  would  offer  3  days. 
We'll  have  it  by  COB  on  Thursday. 

MJ:  So,  you  are  going  to  have  this  on  COB  on  Friday,  and  you 

want  me  to  rule  by  the  end  of  the  week. 

TC [MAJ  FEIN]:  COB  Thursday. 

MJ:  COB  Thursday  and  you  want  me  to  rule  Friday  morning? 

TC [MAJ  FEIN]:  Very  short  and  concise,  brief.  We  can  go 
earlier,  ma'am. 

MJ:  How  about  COB  Wednesday. 

TC [MAJ  FEIN]:  Yes,  ma'am. 

MJ:  Can  you  do  that? 


8180 


© 


o 


1  CDC[MR.  COOMBS]:  We  are  at  a  disadvantage  because  all  of  us 

2  are  in  court.  The  government  has  other  counsel  that  can  prep  this. 

3  MJ:  If  you  get  it  to  me  by  the  end  of  the  week  and  I  rule  on 

4  Monday,  will  that  work? 

5  CDC [MR .  COOMBS]:  That  can  work,  ma'am. 

6  ATC[CPT  MORROW]:  Yes,  ma'am,  when  I  said  the  end  of  the  week, 

7  Your  Honor,  I  actually  meant  that  I  thought  that  it  could  be 

8  submitted  by  the  end  of  the  week  and  then  ruled  on  - 

9  MJ:  The  following  week? 

10  ATC [CPT  MORROW]:  Yes. 

11  MJ:  So  we  submit  it  on  COB  on  Thursday.  Does  that  work?  That 

12  way  if  there's  any  issues  we  can  address  it  on  it  Friday?  Or  are  you 

13  looking  at  COB  Friday? 

14  CDC [MR.  COOMBS:  We  were  looking  at  COB  Friday,  ma'am. 

15  TC [MAJ  FEIN]:  Friday,  ma'am. 

16  MJ:  Or  are  you  looking  at  COB  Saturday? 

17  TC [MAJ  FEIN]:  Friday  works,  ma'am. 

18  CDC [MR.  COOMBS]:  If  you  are  giving  me  Saturday,  I'll  take 

19  Saturday,  ma'am.  One  moment.  Your  Honor, 

20  TC [MAJ  FEIN]:  Saturday  is  fine  as  well,  ma'am. 

21  MJ:  All  right.  We'll  go  COB  Saturday.  I  will  rule  the 

22  following  week.  What  I  would  ask  though  is  you  identify  authorities 

23  to  me  that  you  know  of.  Can  you  get  me  the  copies  of  whatever 
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1  authorities  you  have  that  are  germane  to  this  issue  so  I  could  at 

2  least  look  at  those  earlier? 

3  CDC[MR.  COOMBS]:  Yes,  ma'am.  I'll  get  those  to  you  tonight. 

4  MJ:  All  right.  Government,  same  thing  if  you  know  of  any 

5  authorities  that  support  your  case,  get  them  to  me  as  soon  as  you  can 

6  and  I'll  expect  your  briefs  then  on  Saturday  and  will  rule  next  week. 

7  TC [MAJ  FEIN]:  Yes,  ma'am. 

8  ADC [CPT  TOOMAN] :  Ma'am,  I'm  sorry.  Would  you  like  hard  copy 

9  or  e-mail,  or  electronic,  what's  your  preference? 

10  MJ:  I  would  like  both. 

11  ADC [CPT  TOOMAN]:  Happy  to  do  it,  ma'am. 

12  MJ:  Thank  you.  Is  there  anything  else  we  need  to  address 

13  today? 

14  TC [MAJ  FEIN]:  No,  ma'am. 

15  CDC[MR.  COOMBS]:  Nothing  from  the  defense.  Your  Honor. 

16  MJ:  Start  same  time  tomorrow. 

17  CDC [MR .  COOMBS]:  Yes,  ma'am. 

18  ATC [CPT  MORROW]:  With  —  I  just  want  clarification,  with 

19  respect  to  that  authority  are  you  speaking  specifically  to  the 

20  Internet  archive  or  Twitter. 

21  MJ:  No.  I'm  speaking  legal  authority.  They  cited  to  me  cases. 

22 
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1  ATC [CPT  MORROW]:  Yes,  related  to  the  Internet  archive, 

2  related  to  the  authentication  of  the  information  of  the  Internet 

3  archive. 

4  MJ:  If  you  have  any  authority  that  is  germane  to  this  motion  or 

5  any  of  the  three  objections.  I  believe  they  were  hearsay, 

6  authentication,  and  relevance  that  you  want  me  to  —  or  that  you 

7  already  have  that  you  want  me  to  consider,  I  would  appreciate  it  in 

8  advance.  More  time  is  always  better  for  me. 

9  ATC [CPT  MORROW]:  Yes,  ma'am. 

10  MJ:  All  right.  Is  there  anything  else  we  need  to  address? 

11  ADC  [CPT  TOOMAN] :  No,  ma'am. 

12  TC [MAJ  FEIN]:  No,  ma'am. 

13  MJ:  The  Court  is  in  recess. 

14  [The  court-martial  recessed  at  1656,  10  June  2013.] 
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1  [The  court-martial  was  called  to  order  at  0935,  11  June  2013.] 

2  MJ:  Court  is  called  to  order.  Major  Fein,  please  account  for 

3  the  parties. 

4  TC [MAJ  FEIN]:  Yes,  ma'am.  Your  Honor,  all  parties  when  the 

5  Court  last  recessed  are  again  present,  with  the  following  exceptions: 

6  Captain  Overgaard  and  Captain  Morrow  are  absent.  Captain  von  Elten 

7  is  present. 

8  MJ:  Is  the  Government  —  Well  are  there  any  issues  we  need  to 

9  address  before  we  proceed? 

10  TC [MAJ  FEIN]:  Yes,  ma'am.  A  few  admin  issues.  First,  this 

11  morning  United  States  filed  what's  been  marked  as  Appellate  Exhibit 

12  566,  the  witness  list  order  and  proposed  PEs,  for  the  prosecution 

13  witnesses.  That's  an  updated  listing  from  the  previous. 

14  MJ:  All  right.  Thank  you. 

15  TC [MAJ  FEIN]:  Also,  ma'am,  as  of  0930  this  morning  there  are  11 

16  members  of  the  media  at  the  media  operations  center.  There  are  two 

17  stenographers.  There's  no  one  presently  in  the  trailer,  although  the 

18  trailer  is  available  and  the  courtroom  is  not  filled  to  capacity. 

19  MJ:  All  right.  Thank  you  very  much. 

20  CDC [MR .  COOMBS]:  Ma'am,  I  would  like  to  put  on  the  record 

21  that  the  government  has  indicated  pretty  much  from  this  day  forward 

22  they'll  accommodate  the  request  of  the  stenographers  to  have  one  come 

23  in  the  morning,  one  come  in  the  afternoon  session,  and  that  also  the 
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1  stenographers  will  be  given  a  dedicated  pass  for  the  media  operations 

2  center. 

3  MJ:  Is  that  correct? 

4  TC [MAJ  FEIN]:  Yes,  ma'am.  But  also,  the  United  States' 

5  understanding  is  that  the  Court  —  or  the  Court's  preference  or 

6  directive  is  that  one  of  the  70  spots  for  the  media  will  actually 

7  become  69  spots  and  a  stenographer  will  be  the  70th  spot,  so  it  will 

8  actually  not  be  a  media  spot,  it  will  be  the  stenographer  position. 

9  That  way  the  Public  Affairs  will  credential  off  69  positions,  not  70. 

10  MJ:  That  is  actually  what  I  did  direct  you  to  do.  Any 

11  objection  to  that? 

12  CDC [MR.  COOMBS]:  No  objection.  Your  Honor. 

13  MJ:  All  right.  Anything  else  we  need  to  address? 

14  CDC [MR.  COOMBS]:  No,  Your  Honor. 

15  TC [MAJ  FEIN]:  No,  ma'am. 

16  MJ:  All  right.  Please  call  your  next  witness. 

17  TC [MAJ  FEIN]:  Ma'am,  prior  to  that  we're  going  to  read  two 

18  stipulations. 

19  MJ:  Can  you  tell  me  who  those  are? 

20  TC [MAJ  FEIN]:  Yes,  ma'am.  Ma'am,  the  first  stipulation  is  Mr. 

21  Peter  Artale,  Prosecution  Exhibit  70.  The  next  is  Mr.  Sean 

22  Chamberlin,  Prosecution  Exhibit  71. 

23  MJ:  Thank  you. 
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1  TC [MAJ  FEIN]:  Your  Honor,  Stipulation  of  Expected  Testimony  of 

2  Mr.  Peter  Artale,  dated  9  June  3013.  It  is  hereby  agreed  by  the 

3  Accused,  Defense  Counsel,  and  Trial  Counsel,  that  if  Mr.  Peter. 

4  Artale  were  present  to  testify  during  the  merits  and  pre-sentencing 

5  phases  of  this  court-martial,  he  would  testify  substantially  as 

6  follows: 

7  I  am  currently  employed  by  the  Army  Counter-Intelligence 

8  Center,  ACIC,  with  the  902nd  Military  Intelligence  Group  on  Fort 

9  Meade,  Maryland.  ACIC  produces  finished  intelligence  products  for 

10  the  Intelligence  community.  It  often  produces  these  products  by 

11  fulfilling  requests  for  information  from  the  Army.  It  takes  finished 

12  products  and  disseminates  them  on  SIPRNET  and  JWICS.  I  am  a  Web 

13  Developer  and  the  Team  Lead  of  a  team  of  three  software  developers. 

14  I  have  worked  in  this  capacity  and  for  ACIC  for  8  years.  Prior  to 

15  this  position,  I  worked  in  web  development  for  the  Defense 

16  Intelligence  Agency,  DIA,  for  1  year,  then  with  Booz  Allen  for  a  1- 

17  year  contract  with  National  Geo-Spatial  Agency.  I  was  a  Software 

18  Development  Engineer  and  Programmer  in  the  Air  Force  for  21  years.  I 

19  retired  from  the  Air  Force  as  a  Master  Sergeant.  I  also  have  an 

20  Associate's  degree  in  Computer  Science. 

21  I  first  became  involved  in  this  case  on  approximately  17 

22  March  2010,  after  my  Branch  Chief,  Ms.  Jessica  Johnson,  alerted  me  to 

23  the  compromise  of  U.S.  Government  information.  Ms.  Johnson  asked  if 
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1  I  could  use  our  system  to  see  who  had  viewed  a  certain  product.  I 

2  could,  as  I  had  developed  custom  software  to  track  access  two 

3  particular  products.  This  software  captures  the  viewer  credentials 

4  by  recording  the  Internet  Protocol  (IP)  address  and  date/time  of 

5  access  for  each  user  who  views  our  ACIC  work  product.  It  then 

6  assigns  a  unique  report  key  to  the  access  event.  This  occurred 

7  before  we  were  contacted  by  law  enforcement  in  this  case,  as  ACIC  was 

8  notified  of  the  compromise  of  one  of  our  products  in  March  2010. 

9  An  IP  address  is  part  of  the  Transmission  Control 

10  Protocol/Internet  Protocol  (TCP/IP) .  A  protocol  is  the  standard 

11  language  used  to  communicate  over  a  network.  TCP/IP  is  the  most 

12  common  "language"  that  computers  use  to  communicate  over  the  Internet 

13  and  so  an  IP  address  is  the  method  of  identifying  a  specific  computer 

14  on  a  network.  Only  one  computer  can  be  assigned  a  specific  IP 

15  address  at  one  time.  Knowing  an  IP  address  allows  us  to  know  which 

16  computer  on  a  given  network  used  our  products.  Our  software  is  a 

17  custom  product  which,  in  capturing  this  user  and  access  information, 

18  produces  metrics  which  can  be  used  to  see  which  of  our  products  are 

19  most  popular  and  how  our  products  are  used.  The  software  only  logged 

20  views  of  the  document  in  the  ".asp"  format  which  is  the  standard  way 

21  the  product  would  appear  on  the  website,  ".asp"  is  a  common  file 

22  format  for  web  pages.  This  means  that  the  software  only  logged  views 

23  of  the  web  version  of  the  document  and  not  the  views  of  the  ".pdf"  or 
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1  ".doc"  versions  of  the  document.  Likewise,  the  logs  do  not  indicate 

2  whether  the  document  was  printed  or  saved,  nor  do  they  indicate  how 

3  long  an  individual  looked  at  the  document,  if  at  all.  We  collect 

4  this  data  normally  so  we  can  analyze  it  to  see  where  we  need  to 

5  allocate  our  development  and  maintenance  resource  —  resources  to 

6  best  support  our  internal  and  external  customers.  The  information 

7  produced  by  the  tracking  software  is,  therefore,  called  metrics. 

8  The  metrics  are  pulled  when  an  engineer  runs  a  certain 

9  query.  These  queries  can  be  customized  to  pull  only  the  information 

10  the  developer  wants  to  see.  In  this  case,  we  were  specifically 

11  interested  in  tracking  every  access  to  a  product  called  —  excused 

12  me,  titled  "WikiLeaks . org-An  Online  Reference  to  Foreign  Intelligence 

13  Services,  Insurgents,  or  Terrorists  Groups."  Therefore,  I  searched 

14  the  product  by  determining  and  searching  for  its  product 

15  identification  number,  which  is  "RB08-0617".  The  product 

16  identification  number,  which  is  on  the  document  itself  and  assigned 

17  internally  by  ACIC,  is  a  identifier  unique  to  each  ACIC  product. 

18  This  ACIC  product  "WikiLeaks.org  An  Online  Reference  to 

19  Foreign  Intelligence  Services,  Insurgents,  or  Terrorists  Groups"  is 

20  housed  on  our  website  at  "acic.north-inscom.army.smil.mil"  and  is 

21  accessible  only  via  a  classified  network,  such  as  SIPRNET.  I  wrote  a 

22  custom  query,  by  IP  address  and  visit  time,  to  see  every  time  this 

23  particular  document  wrote,  or  was  pulled  from  the  web  server.  A 
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1  custom  query  is  a  method  of  pulling  information  from  a  database.  I 

2  pulled  these  metrics  from  my  own  workstation.  The  data  is 

3  automatically  pulled  into  a  Structured  Query  Language  (SQL)  table. 

4  SQL  is  a  computer  language  for  extracting  and  inserting  information 

5  in  a  database.  It  is  a  standard  computer  language  to  interact  with 

6  databases.  Printouts  of  SQL  queries  look  like  an  Excel  spreadsheet 

7  in  that  it  has  columns  and  rows;  however,  it  is  not  as  easy  to  search 

8  and  organize  as  an  Excel  spreadsheet.  I,  therefore,  digitally  cut 

9  and  pasted  the  information  from  the  SQL  table  into  an  Excel 

10  spreadsheet  and  saved  the  data  to  my  desktop.  I  then  organized  the 

11  spreadsheets  in  two  separate  manners.  The  first  set  is  organized  by 

12  visit  date.  The  second  is  organized  by  IP  address  and  then  visit 

13  date.  I  did  not  alter  the  content  of  the  data  in  any  way  when 

14  searching  for  the  data,  moving  it  from  the  SQL  table  to  the  Excel 

15  spreadsheet,  or  while  in  the  Excel  spreadsheet.  I  moved  the 

16  information  and  organized  it  in  two  separate  manners  because  it  was 

17  easier  to  read.  I  then  emailed  the  metric  data  to  my  leadership  at 

18  ACIC  as  requested.  The  data  is  stored  securely  on  our  servers  and  is 

19  only  accessible  to  the  other  three  web  developers  on  my  team.  I  have 

20  no  reason  to  believe  anyone  else  would  have  modified  the  logs  in  any 

21  way.  This  occurred  before  we  were  contacted  by  investigators 

22  involved  in  this  case,  as  ACIC  was  notified  of  the  compromise  of  one 

23  of  our  products  in  March  2010. 
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1  In  this  case,  the  ACIC  document  concerned  was  posted  in 

2  2008.  I  pulled  the  metric  data  tracking  access  to  this  document  on 

3  17  March  2010.  The  most  recent  access  date  listed  in  the  metric  data 

4  is  16  March  2010.  The  data  returned  included  view  --  The  data 

5  returned  included  views  —  excuse  me.  Your  Honor,  view  hits  on  the 

6  document  up  until  the  morning  I  ran  the  data  query.  The  logs  are 

7  broken  down  by  record  key,  IP  address,  and  visit  date.  Specifically, 

8  the  metrics  tell  me  the  following  about  the  user  IP  addresses  who 

9  opened  the  website  containing  the  product  with  a  product 

10  identification  number  of  RB-08-0617  in  the  web  page  format:  A  user 

11  with  the  IP  address  22.225.41.40  opened  the  web  page  on  1  December 

12  2009,  at  6:31  PM;  a  user  with  the  IP  address  22.225.41.40  opened  the 

13  web  page  on  29  December  2009,  at  2:40  PM;  a  user  with  the  IP  address 

14  22.225.41.40  opened  the  web  page  on  1  March  2010,  at  6:40  PM;  and  a 

15  user  with  the  IP  address  22.225.41.22  opened  the  web  page  on  7  March 

16  2010,  at  11:31  PM. 

17  The  data  for  these  metrics  is  collected  by  our  custom 

18  software  automatically  when  someone  clicks  on  one  of  our  links  to  use 

19  our  ACIC  work  product.  This  system  captures  the  date  —  excuse  me, 

20  Your  Honor,  the  time,  date,  and  IP  address  as  well  as  which  product 

21  is  being  accessed  and  served  out  to  the  requester.  We  know  this  data 

22  is  accurate  because  there  is  no  human  intervention  into  the  process 
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1  and  because  views  are  logged  using  specific  codes  and  for  specific 

2  products. 

3  Finally,  while  it  is  possible  to  make  manual  insertions  in 

4  metric  data  output,  those  insertions  cannot  be  backdated  or 

5  overwritten.  This  means  whatever  output  data  the  system  produces 

6  cannot  itself  be  altered.  Furthermore,  at  the  time  I  pulled  the 

7  logs,  I  did  not  know  to  whom  the  IP  addresses  were  attached  or  the 

8  reasons  for  which  the  data  was  being  pulled.  I  had  neither  the 

9  motivation  nor  knowledge  required  to  alter  the  document .  At  no  point 

10  prior  to  pulling  the  metric  log  data,  while  pulling  the  information, 

11  or  after  securing  it,  did  I  ever  alter  the  data  in  any  way. 

12  My  Branch  Chief  forwarded  my  email  with  these  metrics  to 

13  Mr.  Winston  Budram,  S-6  and  Chief  Information  Officer  of  the  902nd  MI 

14  Group.  Mr.  Budram  forwarded  the  metrics  to  investigators  after  they 

15  contacted  our  office.  Prosecution  Exhibit  63  for  Identification  is 

16  the  paper  copy  of  these  logs.  Prosecution  Exhibit  63  for 

17  Identification  is  a  printout  of  the  complete  logs  that  I  pulled.  I 

18  put  the  title  "Views  of  ACIC  Product  RB08-06.  --  or  excuse  me, 

19  0617. asp"  on  the  top  of  the  Excel  spreadsheet.  The  title  is  based  on 

20  the  ACIC  product  identification  number  and  the  format  of  the 

21  document.  On  the  left  side  of  every  page  are  the  logs  that  I  pulled 

22  and  organized  by  visit  date.  On  the  right  side  of  every  page  are  the 

23  logs  that  I  pulled  and  organized  by  IP  address  and  then  visit  date. 
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1  I  believe  the  information  on  the  top  of  the  page  "Views  of  ACIC 

2  Product  RB08-0617 . asp" ;  "Record  Key";  "IP  Address";  and  "Visit  Date", 

3  which  is  the  same  as  the  title  and  heading  information  on  the 

4  spreadsheets  that  I  pulled,  was  automatically  produced  by  Excel  when 

5  the  spreadsheets  were  printed. 

6  I  am  the  custodian  of  the  records  marked  as  PE  63  for  ID 

7  and  an  employee  —  and  an  employee  familiar  with  the  manner  and 

8  process  in  which  these  records  are  created  and  maintained,  by  virtue 

9  of  my  duties  and  responsibilities.  PE  63  for  ID  was  made  at  or  near 

10  the  time  of  the  occurrences  of  the  matters  set  forth  by  or  from 

11  information  transmitted  by,  people  with  knowledge  of  these  matters. 

12  PE  63  for  ID  was  kept  in  the  course  of  regularly  conducted  business 

13  activity.  It  was  the  regular  practice  of  the  business  activity  to 

14  make  the  records.  The  records  marked  as  PE  63  for  ID  are  a  true, 

15  accurate,  and  complete  copy  of  the  original  documents. 

16  Your  Honor,  the  United  States  moves  to  admit  PE  63  for  ID 

17  as  PE  63. 

18  ADC [MAJ  HURLEY]:  No  objection,  ma'am. 

19  MJ:  All  right.  Prosecution  Exhibit  63  is  admitted.  May  I  see 

20  it,  please?  Thank  you. 

21  TC [MAJ  FEIN]:  Ma'am,  Stipulation  of  Expected  Testimony  of  Mr. 

22  Sean  Chamberlin  dated  9  June  2013. 
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1  It  is  hereby  agreed  by  the  Accused,  Defense  Counsel,  and 

2  Trial  Counsel,  that  if  Mr.  Sean  Chamberlin  were  present  to  testify 

3  during  the  merits  and  pre-sentencing  phases  of  this  court-martial, 

4  he  would  testify  substantially  as  follows: 

5  I  am  a  Systems  Administrator  for  the  S-6  shop  of  the  902nd 

6  Military  Intelligence  (MI)  Group  on  Fort  Meade,  Maryland.  The  902nd 

7  MI  Group  performs  counterintelligence  functions.  My  section  is 

8  responsible  for  providing  IT  support  for  all  unit  servers.  In  this 

9  capacity,  I  build  new  servers  and  maintain  old  ones.  I  have  worked 

10  in  this  capacity  for  10  years.  Before  that  I  was  an  active  duty 

11  military  for  9  years  and  was  a  Staff  Sergeant  when  I  left  the  Army. 

12  For  the  last  5  of  my  9  years  of  active  duty  service,  I  had  the 

13  Military  Occupational  Specialty  (MOS)  of  33W,  which  is  Inter  —  which 

14  is  Intercept  Electronic  Warfare  Systems  Repair.  In  that  capacity,  I 

15  was  a  systems  administrator.  To  fulfill  my  current  function,  I  have 

16  received  Security  Plus  training  and  have  certifications  in  numerous 

17  Microsoft  server  types.  I  also  hold  a  Bachelor's  degree  in 

18  Information  Systems  from  the  University  of  Phoenix. 

19  I  first  became  involved  in  the  present  case  in  July  of 

20  2011,  when  my  supervisor  Mr.  Robert  Conner,  the  Site  Lead  for 

21  Information  Technology  at  the  902nd  MI  Group,  requested  that  I  pull 

22  Microsoft  Internet  Information  Services  (MIIS)  web  server  audit  event 

23  logs  for  the  contacting  IP  addresses  22.225.41.22  and  22.225.41.40 
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1  between  the  dates  November  2009  and  May  2010.  MIIS  are  application 

2  logs  that  are  specific  to  the  web  server.  Audit  logs  are  a  record  of 

3  the  activity  that  occurs  on  the  server  and  enable  system 

4  administrators  like  me  to  track  what  users  do  on  the  website.  Audit 

5  logs  contain  data  that  is  automatically  written  to  them  on  a  daily 

6  basis.  Here,  the  audit  logs  record  file  activity  on  a  web  server 

7  from  the  United  States  Government  computer  assigned  to  the  IP  address 

8  199.32.48.154,  is  a  computer  dedicated  to  processing  classified 

9  information  at  the  Secret  level.  This  is  the  IP  address  for  the  ACIC 

10  website  on  SIPRNET . 

11  This  data  shows  what  IP  addresses  accessed  our  system 

12  within  that  date  range.  An  IP  address  is  part  of  the  Transmission 

13  Control  Protocol/Internet  Protocol  (TCP/IP) .  A  protocol  is  the 

14  standard  language  used  to  communicate  over  a  network.  TCP/IP  is  the 

15  most  common  "language"  that  computers  use  to  communicate  over  the 

16  Internet.  An  IP  address  is  the  method  of  identifying  a  specific 

17  computer  on  a  network. 

18  An  IP  address  allows  us  to  know  which  computer  on  a  given 

19  network  accessed  our  server.  In  this  case,  I  pulled  18  log  files  for 

20  the  above  IP  address  and  date  range.  The  files  are  named  the 

21  following:  ex09119.log;  ex091201.log;  ex091214.log;  ex091217.log; 

22  ex091221.log;  ex091229.log;  exl00207.log;  exl00209.log;  exl00211.log; 

23  exl00214.log;  exl00301.log;  exl00302.og;  exl00308.log;  exl00315.log; 
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exl00316.log;  exl00317.log,  which  is  the  automatic  naming  convention 
of  Microsoft  based  on  date.  The  files  display  in  text  format.  The 
files  contain  86  entries  for  the  IP  address  of  22.225.41.22  and  28 
entries  for  the  IP  address  of  22.225.41.40.  The  first  entry  for 
22.225.41.22  or  22.225.41.40  is  19  November  2010. 

These  logs  are  on  our  external  web  server,  which  is  one  of 
the  servers  I  am  responsible  for  maintaining.  The  web  server  and  the 
logs  are  located  in  what  is  commonly  referred  to  as  the  "DMZ" ,  which 
is  the  area  between  our  internal  system  and  the  SIPRNET.  I  pulled 
the  data  using  a  search  window  and  searching  the  IP  address  for  the 
given  date  range.  Then  I  searched  for  the  two  requested  IP 
addresses.  I  then  put  the  files  into  an  internal  investigation 
folder  and  had  them  burned  to  a  disc.  I  looked  at  the  disc  to  verify 
that  they  were  the  logs  that  I  pulled. 

I  am  familiar  with  these  logs  because  of  my  work  as  a 
systems  administrator.  After  I  pulled  the  logs,  they  were  burned 
onto  a  rewritable  disc  by  another  individual.  I  reviewed  the 
contents  of  the  disc  to  ensure  it  contained  the  logs  I  pulled.  The 
disc  labeled  "Log  Files  902nd  MI  2011-0006"  contain  the  logs  that  I 
pulled.  Prosecution  Exhibit  64  for  Identification  is  a  copy  of  this 
disc.  I  attested  to  the  authenticity  of  these  logs  on  21  June  2012, 
Bates  number:  00449439.  I  pulled  the  logs  from  the  server  and  did 
not  alter  the  content  of  the  logs  in  any  way.  I  have  no  reason  to 
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believe  anyone  else  would  have  modified  the  logs  in  any  way  while 
they  are  on  the  server  as  permissions  to  the  "DMZ"  are  very  limited. 

Your  Honor,  the  United  States  moves  to  admit  Prosecution 
Exhibit  64  for  Identification  as  Prosecution  Exhibit  64. 

ADC [MAJ  HURLEY]:  Ma'am,  we  have  no  objection  to  that;  but  may 

I  have  a  second  to  speak  with  Major  Fein? 

MJ:  Yes. 

[There  was  a  brief  pause  while  the  assistant  defense  counsel 
consulted  with  the  trial  counsel . ] 

TC [MAJ  FEIN]:  Your  Honor,  the  United  States  requests  a  brief  in 


place  recess. 

MJ:  Go  ahead.  I'm  not  actually  recessing  the  Court.  I'm  just 

going  to  let  you  do  what  you  need  to  do. 

TC [MAJ  FEIN]:  Yes,  ma'am. 

[There  was  a  brief  pause  while  the  assistant  defense  counsel 
consulted  with  the  trial  counsel . ] 

TC [MAJ  FEIN]:  Ma'am,  I  have  retrieved  Prosecution  Exhibit  64 
and  consulted  with  defense  counsel  and  there  has  been  one 
modification  to  the  Stipulation  of  Expected  Testimony.  I  handed  the 
court  reporter  PE  64  and  I  would  direct  the  Court  to  Page  2.  Your 
Honor,  the  top  of  Page  2  at  the  end  of  the  first  paragraph  or  the 
first  partial  paragraph,  the  date  19  November  2010  has  been  modified 
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to  say  19  November  2009,  and  the  accused's.  Major  Hurley's  and  Major 
Fein's  initials  are  annotated  on  that  change. 

MJ:  All  right.  Major  Hurley,  does  the  defense  agree  with  this 

change? 

ADC [MAJ  HURLEY] :  Yes,  ma'am. 

MJ:  PFC  Manning? 

ACC:  Yes,  Your  Honor. 

ATC [CPT  von  ELTEN] :  Ma'am,  the  United  States  calls  Matthew 
Hosburgh . 

MJ:  May  I  see  Prosecution  Exhibit  64?  I  think  I  still  need  to 

admit  that.  Is  that  better  done  at  a  recess? 

TC [MAJ  FEIN]:  Yes,  ma'am,  64. 

MJ:  Prosecution  Exhibit  64  for  Identification  is  admitted. 

Excuse  me.  Captain  von  Elten,  who  is  the  next  witness? 

ATC [CPT  von  ELTEN]:  Matthew  Hosburgh,  ma'am. 

STAFF  SERGEANT  MATTHEW  HOSBURGH,  U.S.  Marine  Corps  Reserve,  was 
called  as  a  witness  for  the  prosecution,  was  sworn,  and  testified  as 
follows : 

DIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  von  ELTEN] : 

Q.  For  the  record,  you're  Sergeant  Matthew  Hosburgh  of  Denver, 
Colorado? 

A.  Staff  Sergeant,  sir. 
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Q.  Where  do  you  work? 

A.  I'm  currently  working  for  an  oil  and  gas  company  in  Denver, 


Colorado . 

Q.  And  what  do  you  do  there? 

A.  I  do  their  IT  security. 

Q.  And  what  does  that  entail? 

A.  It  entails  monitoring  the  networks  as  well  as  threat  and 
vulnerability  research. 

Q.  And  how  long  have  you  been  in  this  position? 

A.  I've  been  there  for  about  2  months  now,  sir. 

Q.  And  what  was  your  position  prior  to  that? 

A.  Prior  to  that  I  was  a  government  contractor  where  I  did 

basically  the  same  type  of  work  for  citizenship  and  immigration. 

Q.  And  what  department  does  citizenship  and  immigration  fall 
under? 


A. 

Q. 

A. 

Q. 

A. 

threats, 

Q. 

A. 


Department  of  Homeland  Security. 

And  how  long  were  you  there? 

I  was  there  for  3  years. 

And  how  was  the  work  similar;  what  did  you  do? 

Same  type  of  thing,  monitoring  networks,  looking  for 
vulnerabilities  and,  yeah,  that's  basically  it. 

And  what  did  you  do  prior  to  that? 

Prior  to  that  I  was  on  active  duty  in  the  Marine  Corps. 
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Q.  And  for  how  long  were  you  on  active  duty? 

A.  For  8  years. 

Q.  What  was  your  MOS  in  the  Marine  Corps? 

A.  I  was  a  2651. 

Q.  What  is  that? 

A.  It's  a  Special  Intelligence  System  Administrator. 

What  training  did  you  receive  in  that  position? 

I  received  numerous  military  schools  as  well  as  civilian  IT 
security  related  courses. 

Q.  And  what  did  those  —  What  kind  of  things  did  that 
schooling  teach  you? 

A.  Everything  from  system  administration,  servers,  networks, 
to  security,  basic  security  and  things  of  that  nature. 

Q.  What  kind  of  work  did  being  a  2651  entail? 

A.  Kind  of  ran  the  gamut  as  far  as  anything  from,  you  know, 
managing  servers  and  network  equipment  to  information  assurance  and 
security  accreditation  and  threat  and  vulnerability  research. 

Q.  What  kind  of  systems  did  you  work  on? 

A.  Worked  primarily  on  classified  network  systems,  servers  and 
networks  of  that  nature. 


8199 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


o 


o 


Q.  And  what  kind  of  work  did  you  do  on  those  classified 
systems? 

A.  Managed  the  systems,  provided  access  to  our  users  as  well 
as  I  was  in  charge  of  the  security  of  those  systems.  So  we  had  to 
basically  apply  policy  to  those  systems  as  well  as  manage  the 
vulnerabilities  and  risks  that  the  systems  faced. 

Q.  What  year  did  you  leave  active  duty? 

A.  2010. 

Q.  What  is  your  current  military  status? 

A.  I'm  a  reservist. 

Q.  When  did  you  join  the  reserves? 

A.  I  joined  in  July  of  2012. 

Q.  What  do  you  do  in  the  reserves? 

A.  I  am  a  —  I  have  the  same  MOS  so  I  do  the  same  type  of 
general  work,  but  I'm  currently  working  as  a  network  analysis  or  I'm 
a  network  analyst. 

Q.  Let's  talk  a  little  bit  about  a  report  you  wrote.  Where 
were  you  stationed  in  late  2009  early  2010? 

A.  I  was  in  Stuttgart,  Germany. 

Q.  And  what  were  you  doing  there? 

A.  I  had  been  stationed  there,  started  out  in  2006. 

Q.  Do  you  remember  attending  a  conference? 

A.  Yes,  sir. 
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Q.  What  was  the  conference  called? 

A.  It  was,  the  title  of  the  conference  was  called  Here  Be 
Dragons . 

Q.  And  who  hosted  the  conference? 

A.  It  was  hosted  by  the  Chaos  Computer  Club. 

MJ:  What  dragons? 

WIT:  Here  Be  Dragons. 

Q.  How  else  is  the  Chaos  Communication  Congress  known? 

A.  It's  either  known  as  CCC  or  C3 . 

Q.  How  did  you  know  about  C3? 

A.  Through  my  research  that  I  was  doing  just  trying  to  stay 
ahead  of  security  threats,  I  noticed  that  the  conference  was 
basically  in  our  neck  of  the  woods  and  that's  how  I  found  out  about 
it. 

Q.  And  where  was  the  conference? 

A.  It  was  in  Berlin. 

Q.  And  when  did  the  conference  occur? 

A.  It  was  roughly  the  26th  of  December  2009,  through  the  30th, 
if  I  remember  correctly. 

Q.  What  is  the  C3  conference? 

A.  So  the  C3  conference  essentially,  what  it  actually  stands 
for  is  the  Chaos  Communication  Congress.  It's  a  conference  that 
basically  combines  or  brings  together  people  throughout  the  hacker 
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community,  security  researchers  and  just  random  people,  brings  them 
all  together  and  they  talk  about  various  topics  ranging  from 
security,  hacking,  political  issues.  I  mean  you  name  it  and  it's 
probably  there. 

Q.  And  how  often  is  it  held? 

A.  It's  held  yearly. 

Q.  And  why  did  you  attend? 

A.  I  attended,  it  was  an  opportunity  to  not  only  attend  a 
conference  that  could  potentially  I  guess  show  some  security 
vulnerabilities  that  we  might  be  able  to  apply  to  our  command,  but  it 
was  also  local  and  we  had  some  extra  funds  to  go  travel  and  go  to 
that  conference,  so  - 

Q.  How  many  days  was  the  conference? 

A.  I  believe  it  was  5  days. 

Q.  And  how  many  days  did  you  attend? 

A.  I  was  there  for  4  days.  One  day  was  for  travel. 

Q.  How  many  people  attended  the  conference? 

A.  Roughly  about  3  to  5,000  I  believe. 

Q.  What  kind  of  facility  hosted  the  conference? 

A.  It  was  your  standard  just  conference  center,  multiple  rooms 
that  could  host  various  talks  and  presentations. 
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Q.  And  where  were  the  featured  presentations  given? 

A.  The  featured  presentations?  Those  were  reserved  for  the 
bigger  rooms  of  the  conference  center. 

Q.  And  about  how  big  was  the  bigger  room? 

A.  How  many  people? 

Q.  How  many  people  did  it  seat? 

A.  How  many  people?  Okay.  Roughly  maybe  5  to  1,000  people. 

Q.  500  to  1,000  people? 

A.  I'm  sorry.  Yeah,  500,  yes,  sir. 

Q.  What  were  some  of  the  main  presentations? 

A.  Some  of  the  main  presentations  I  recall  offhand  they  were 
talking  about,  one  of  the  big  ones  was  WikiLeaks,  they  talked  about 
Net  Neutrality,  Tor  came  up.  They  talked  about  various  topics 
related  to  GSM  cellphone  networks.  A  few  others,  I  just  can't  recall 
off  the  top  of  my  head. 

Q.  And  what  language  were  the  talks  given  in? 

A.  They  were  given  in  English  and  some  of  them  were  also  in 

German . 

Q.  Let's  talk  a  little  bit  about  the  Net  Neutrality 
presentation.  How  many  speakers  gave  that  presentation? 

A.  I  recall  I  believe  there  was  two  speakers  for  that  one. 

One  main  presenter,  though. 
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Q.  How  long  did  the  presentation  last? 

A.  That  was  about  an  hour  if  I  remember  that  one  right. 

Q.  And  what  is  Net  Neutrality? 

A.  Well,  Net  Neutrality,  the  way  I  see  it  is  a  way  to  keep  the 
Internet  open  and  free  as  far  as  preventing  any  issues  or  ISPs, 
Internet  service  providers  from  regulating  it.  So  their  issue  or 
their  whole  talk  was  about  we  need  to  keep  the  Internet  open  and  free 
instead  of  having  various  tiers  of  regulation  on  the  Internet. 

Q.  And  what  was  the  purpose  of  the  presentation? 

ADC [MAJ  HURLEY]:  Objection,  ma'am.  Hearsay. 

MJ:  Uhm  - 

ATC [CPT  von  ELTEN] :  Your  Honor,  I  will  - 

MJ:  Establish  a  foundation  and  his  personal  knowledge. 

ATC [CPT  von  ELTEN]:  It  goes  to  the  effect  on  listener  or  on  a 
document  we  are  going  to  offer  as  evidence. 

MJ:  What  was  the  question? 

ATC [CPT  von  ELTEN]:  What  was  the  purpose  of  the  presentation? 

MJ:  Ask  for  the  foundation  of  knowledge.  How  does  he  know 

that? 

[END  OF  PAGE] 
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Questions  continued  by  the  assistant  trial  counsel [CPT  von  ELTEN] : 

Q.  How  do  you  know  that? 

A.  How  do  I  know  what  the  purpose  is?  Because  there's  a 
summary  of  the  talk  before  I  went  and  I  had  done  some  research  about 
that  topic. 

Q.  And  where  did  you  do  your  research? 

MJ:  Overruled. 

Q.  Are  where  did  you  do  your  research? 

A.  Research  just  on  the  open  Internet. 

Q.  And  what  was  the  purpose  of  the  presentation? 

A.  It  was  more  about  awareness,  I  remember  that  one.  It  was 
in  English.  The  speaker  was  making  a  case  for  global  open  Internet, 
but  specifically  for  some  of  the  issues  coming  up  in  France  at  the 
time . 

ADC [MAJ  HURLEY]:  Again,  ma'am,  hearsay.  He's  just  repeating 

what  the  presenter  told  him. 

MJ:  What  are  you  offering  it  for? 

ATC [CPT  von  ELTEN]:  I'm  offering  it  for,  it  goes  to  explain  why 
he  wrote  his  report. 

MJ:  Overruled. 

[END  OF  PAGE] 
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Questions  continued  by  the  assistant  trial  counsel  [CPT  von  ELTEN] : 

Q.  Let's  talk  about  the  WikiLeaks  presentation.  What  room  was 
that  in? 

A.  It  was  in  one  of  the  larger  conference  rooms. 

Q.  About  how  many  people  attended  the  talk? 

A.  That  one  was  probably  closer  to  1,000.  I  remember  it  being 
pretty  full. 

Q.  Who  gave  the  talk? 

A.  The  talk  was  given  by  Julian  Assange. 

Q.  And  how  long  did  Mr.  Assange  speak? 

A.  It  was  about  an  hour  or  so. 

Q.  And  how  was  the  talk  relevant  to  your  work  at  the  time  in 
the  Marines? 

A.  It  was  relevant  in  the  sense  that  I  worked  with  classified 
information  at  the  time. 

Q.  And  what  was  the  purpose  of  the  talk? 

A.  The  main  purpose  of  the  talk  was  really  to  explain  what 
WikiLeaks  was  and  the  launch  of  their,  basically  their  new  site  is 
what  I  got  from  it.  They  talked  about  what  their  intentions  were  and 
then  basically  what  the  system  provided. 

Q.  And  what  were  their  intentions? 

A.  The  intentions  were  they  basically  were  eliciting  support 
from  the  audience  and  then  I  guess  anybody  listening  to  the 
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conference  to  leak  any  type  of  information,  not  only  classified 
information  but  proprietary  trade  secrets,  anything  of  that  nature. 

ATC[CPT  von  ELTEN] :  I  am  retrieving  Prosecution  Exhibit  43  for 
Identification,  handing  it  to  the  witness. 

Q.  Do  you  recognize  the  document  I've  handed  you? 

A.  Yes,  sir. 

Q.  What  is  it? 

A.  This  is  my  trip  report,  or  after  action  report  I  wrote 
after  I  came  back  from  the  conference. 

Q.  When  did  you  write  it? 

A.  I  wrote  it  approximately  a  week  after. 

Q.  How  do  you  know  it's  your  report? 

A.  Well,  it  has  my  name  on  it  and  it's  in  the  format  I'm  used 


Q.  Where  did  you  submit  it? 

A.  Where  did  I  submit  it?  I  submitted  it  to  basically  my 
chain  of  command  when  I  got  back. 

ATC[CPT  von  ELTEN]:  Retrieving  Prosecution  Exhibit  43  for 
Identification  from  the  witness.  Retrieving  Prosecution  Exhibit  85. 
I  am  handing  Prosecution  Exhibit  85  to  the  witness. 

Q.  Would  you  please  take  a  minute  to  review  Line  12?  I 
believe  it's  on  the  second  page. 

[There  was  a  brief  pause  while  the  witness  reviewed  the  exhibit.] 
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A.  Okay. 

Q.  How  often  were  your  reports  posted  online? 

A.  How  often  were  they  posted?  Good  question  because  we  had 

just  implemented  a  new  system,  so  we  didn't  really  have  a  frequency 
of  necessarily  posting  them,  a  standard  procedure  for  that.  Since 
that  new  system,  it  was  kind  of  became  a  de  facto  practice  of  posted 
after  the  trip. 

Q.  And  where  were  they  posted? 

A.  We  posted  to  a  Sharepoint  portal. 

Q.  And  what  was  the  address  of  that  Sharepoint  portal? 

A.  It  was  something  along  the  lines  of  MFE.USMC.smil.mil.  And 
then  your  various  section  be  denoted  by  a  G  representing  and  then  a 
number. 

Q.  Is  that  approximately  the  address  listed  in  Line  12? 

A.  Yes,  sir. 

ATC [CPT  von  ELTEN] :  Retrieving  Prosecution  Exhibit  85.  Your 
Honor,  the  United  States  would  move  to  enter  Prosecution  Exhibit  43 
for  Identification  into  evidence. 

ADC [MAJ  HURLEY]:  No  objection,  ma'am. 

MJ:  May  I  see  it,  please?  Prosecution  Exhibit  43  for 

Identification  is  admitted. 
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Questions  continued  by  the  assistant  trial  counsel  [CPT  von  ELTEN] 


Q. 

Let's  talk  a  little  bit  about  this  report.  How  did  you 

organize 

the  report? 

A. 

I  organized  it  basically  chronologically  so  the  talks  I 

went  to. 

that's  the  first  talk,  and  then  so  on  and  so  forth 

throughout  the  report 


Q. 

What  information  did  you  put  in  the  summary  section? 

A. 

The  summary  was  generally  a  description  basically  from  the 

conference  itself,  and  then  if  there's  anything  I  needed  to  add  to 


make  it. 

to  make  it  more  —  to  it  make  more  sense  to  my  chain  of 

command 


Q. 

And  what  was,  how  did  you  construct  the  sections? 

A. 

The  analysis  was  based  off  of  some  of  the  analytical  work  I 

had  done 

in  our  section  and  also  trying  to  make  that  analysis  fit 

within  our  organization  basically 


Q. 

What  was  the  purpose  of  the  counter  measure  section? 

A. 

That  was  basically  —  The  purpose  behind  that  was  to 

identify 

if  there  was  a  potential  threat,  security  threat  that  maybe 

we  were  vulnerable  to,  and  then  to  see  if  we  could  actually  fix  it, 
fix  that  vulnerability. 

Q.  What  was  the  purpose  of  drafting  this  report? 
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A.  To  basically  summarize  the  trip  so  I  could  show  the  command 
actually  what  I  did  there,  and  then  also  to  raise  some  awareness  as 
far  as,  you  know,  what  the  issues  I  found  there  were. 

ATC [CPT  von  ELTEN] :  Thank  you.  No  further  questions.  Your 
Honor . 

MJ:  Cross-examination. 

ADC [MAJ  HURLEY]:  Yes,  ma'am. 

CROSS-EXAMINATION 

Questions  by  the  assistant  defense  counsel  [MAJ  HURLEY] : 

Q.  Staff  Sergeant  Hosburgh,  good  morning. 

A.  Good  morning,  sir. 

Q.  When  it  comes  to  the  document  that  you  were  just  discussing 
with  Captain  von  Elten,  that's  a  document  that  you  wrote? 

A.  Yes,  sir. 

Q.  By  yourself? 

A.  Yes,  sir. 

Q.  And  it  appears  to  be  a  reflection  of  your  time  spent  at 
this  conference  that  you  discussed  with  Captain  von  Elten? 

A.  Yes,  sir. 

Q.  It  was  rendered  chronologically? 

A.  Yes,  sir. 

Q.  The  first  thing  that  you  covered  was  net  neutrality? 

A.  Yes,  sir. 
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Q.  Then  WikiLeaks? 

A.  Yes,  sir. 

Q.  Then  you'll  forgive  my  computer  ignorance,  exposing  crypto 
bugs  through  reverse  engineering? 

A.  Yes,  sir. 

Q.  And  that  was  followed  by  some  other  more  technical  topics 
of  the  conversation? 

A.  Yes,  sir. 

Q.  And  you  started  with  Paragraph  1,  as  you  were  writing  you 
started  with  Paragraph  1? 

A.  Yes,  sir. 

Q.  And  you  wrote  your  report  chronologically  as  well? 

A.  Chronologically,  yes,  sir. 

Q.  In  your  discussion  of  Net  Neutrality  you  mentioned 
terrorist  use  of  the  Internet? 

A.  Yes,  sir. 

Q.  And  you  mentioned  that  in  Paragraph  1? 

A.  Yes. 

Q.  In  your  discussion  of  WikiLeaks  you  did  not  mention 
terrorism  or  terrorist  use  of  that  site,  correct? 

A.  Correct,  sir. 

Q.  Now,  let's  talk  about  WikiLeaks;  the  presenter  you  said  was 
Julian  Assange? 
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A.  Yes,  sir. 

Q.  And  he  did  not  mention  terrorism  in  his  presentation? 

A.  Not  that  I  can  recall,  sir. 

Q.  Or  a  desire  to  help  terrorists? 

A.  No,  sir. 

Q.  That  would  have  been  reflected  in  your  report? 

A.  Yes,  sir. 

Q.  WikiLeaks  was  focused  on  the  public  and  the  public's  access 
to  information? 

A.  Yes,  sir. 

Q.  Ensuring  openness? 

A.  Yes,  sir. 

Q.  And  keeping  the  public  well  informed? 

A.  That's  what  he  said,  yes,  sir. 

Q.  And  it  wasn't  exclusively  focused  on  the  United  States? 

A.  It  wasn't.  They  did  mention,  there  was  more  of  an  emphasis 
for  classified  information,  however. 

Q.  But  it  wasn't  exclusively  focused  on  classified 
information? 

A.  Correct,  sir. 

Q.  They  were  interested  in  trade  secrets? 

A.  Yes,  sir. 

Q.  And  other  corporate  information? 
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A.  Yes. 

Q.  So  you  mentioned,  let's  go  back  to  that  Paragraph  1, 
terrorists  and  the  use  of  the  Internet.  You  indicated  that 
terrorists  use  the  Internet? 

A.  Yes,  sir. 

Q.  To  communicate  with  each  other? 

A.  Yes. 

Q.  You  indicated  that  an  open  Internet  allows  for  hidden 
communication? 

A.  I  believe  I  recall  that,  sir. 

Q.  It's  sort  of  a,  you  created  this  idea  that  an  open  network 
allows  for  terrorist  communication  on  the  Internet. 

A.  Yes,  sir,  I  did. 

Q.  Their  communication  with  each  other? 

A.  Yes. 

Q.  From  one  terrorist  to  another,  and  then  potentially  from 
there  to  yet  another  terrorist? 

A.  Yes,  sir. 

Q.  And  the  point  as  I  understood  it  —  now,  when  there  was  a 
discussion  of  Net  Neutrality,  did  the  individual  giving  the  Net 
Neutrality  talk  discuss  terrorism? 

A.  No,  sir.  That  was  more  of  an  analytical  piece. 
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Q.  Right.  And  what  you  were  trying  to  show  in  your  analysis 
was  essentially  a  cost  benefit,  right? 

A.  Trying  to  show  that  if  it  was  open,  that  communication 
could  still  exist,  yes,  sir. 

MJ:  What  communication? 

WIT:  Communication  between  the  terrorists.  Generally  speaking, 
that's  a  very  general  term. 

Q.  Right.  And  your  point  was  that  applying  filters  to  the 
Internet  to  make  it  less  unneutral,  to  use  that  expression,  that 
would  —  you  benefit  what  you  get  from  it  with  limiting  terrorist 
communication  against  the  costs  associated  with  making  it  less 
neutral? 

A.  Not  necessarily  a  cost  in  my  mind.  They  did  talk  about 
costs.  It  was  more  along  the  lines  of  if  it's  so  restricted,  they'll 
just  find  another  communication  medium. 

Q.  And  in  your  report  you  did  mention  that  that,  this  making 
the  net  less  neutral  would  cost  money? 

A.  Yes,  sir. 

Q.  And  you  indicated  also  in  your  report  that  there  would  be 
the  potential  for  it  impinging  on  the  free  flow  of  speech? 

A.  Yes,  sir. 
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Q.  In  your  report  what  you  didn't  say  is  that  terrorists  used 
the  Internet  to  gather  information.  Is  that  idea  reflected  in  your 
report? 

A.  Not  specifically,  but  maybe  more  I  was  implying  that,  yes, 

sir. 

Q.  And  you  didn't  say  that  they  used  the  Internet  to  gather 
information  from  open  source  reporting? 

A.  Not  specifically. 

Q.  And  you  didn't  say  that  they  used  the  Internet  or  they  use 
any  specific  website  for  this  open  source  collection? 

A.  Correct. 

Q.  The  thrust  of  your  point  as  you  were  talking  about  Net 
Neutrality  was  terrorists  and  hiding  their  communication  on  the 
Internet? 

A.  Yes,  sir,  generally. 

Q.  You  were,  uhm.  You  were  involved  in  military  intelligence 
while  you  were  on  active  duty  in  the  Marine  Corps? 

A.  Yes,  sir. 

Q.  And  how  long  were  you  an  Intel  NCO  when  you  were  in  the 
Marine  Corps? 

A.  Approximately  about  3  years. 

Q.  And  you're  familiar  with  the  term  intelligence  gaps? 

A.  Yes,  sir. 
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Q.  And  an  intelligence  gap  is  something  we  don't  know? 

A.  More  or  less,  yes,  sir. 

ADC [MAJ  HURLEY]:  No  further  questions,  ma'am. 

MJ:  Redirect? 

ATC [CPT  von  ELTEN] :  Nothing,  ma'am. 

MJ:  All  right.  Temporary  or  permanent  excusal? 

ATC [CPT  von  ELTEN]:  Temporary. 

[The  witness  was  temporarily  excused,  duly  warned,  and  withdrew  from 
the  courtoom.] 

MJ:  I  do  have  a  question  for  the  government.  I'm  looking  at 

exhibit  list,  I'm  looking  at  Prosecution  Exhibits  43  and  44,  which 
appear  to  be  the  same  thing,  one  is  redacted  and  one  is  not. 

TC [MAJ  FEIN]:  Yes,  ma’am. 

MJ:  I  have  only  seen  a  motion  for  admission  for  Prosecution 

Exhibit  43.  Is  that  the  intent? 

TC [MAJ  FEIN]:  The  intent  was  to  use  it  as  a  substitute,  yes, 
ma'am. 

MJ:  Okay. 

TC [MAJ  FEIN]:  Ma'am,  the  Stipulation  —  read  a  Stipulation  of 
Expected  Testimony  for  Lieutenant  Commander  Thomas  Hoskins,  United 
States  Navy  Reserve  dated  10  June  2013. 

MJ:  What  exhibit  is  that? 
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TC [MAJ  FEIN]:  Yes,  ma'am.  This  is  Prosecution  Exhibit  111 
Bravo,  the  unclassified  redacted  version. 

It  is  hereby  agreed  by  the  Accused,  Defense  Counsel,  and 
Trial  Counsel,  that  if  Lieutenant  Commander  Thomas  Hoskins,  United 
States  Naval  Reserve,  were  present  to  testify  during  the  merits  and 
pre-sentencing  phases  of  this  court-martial,  he  would  testify 
substantially  as  follows: 

I  am  a  Lieutenant  Commander  in  the  United  States  Navy 
Reserves.  I  am  a  Reservist.  I  am  currently  assigned  to  United 
States  Pacific  Fleet.  In  1997,  I  obtained  a  Bachelors  of  Science  in 
Marine  Transportation  and  a  BS  in  Environmental  Science  from  the 
Massachusetts  Maritime  Academy.  In  2007,  I  obtained  a  Masters  of 
Business  Administration  from  the  Naval  Postgraduate  School. 

I  entered  active  duty  in  the  United  States  Navy  in  1998  and 
left  active  duty  in  2009.  While  I  was  on  active  duty,  I  was  an  F-18 
pilot.  I  joined  the  United  States  Navy  Reserves  in  2009.  I  have 
logged  over  1700  hours  as  a  pilot,  to  include  approximately  320  hours 
of  combat  flight  time.  I  have  completed  the  requisite  training,  to 
include  6  weeks  of  ground  school;  1  year  of  primary  training  for 
preliminary  flight  instruction;  1  year  of  specialty  training  after  I 
selected  intermediate  training;  and  8  months  of  advanced  training  in 
weapons,  formation  flying,  and  carrier  landing.  After  completing 
that  training,  I  was  selected  to  fly  F-18s  and  received  my  wings. 
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Thereafter,  I  completed  1  year  of  F-18  training  where  I  received 
additional  training  in  weapons  usage,  high  and  low  level  deployment 
of  bombs,  and  carrier  flying.  As  a  pilot,  I  have  served  as  an  F-18 
division  combat  lead.  I  have  operated  weapons  while  deployed  in 
Afghanistan  and  conducted  reconnaissance  while  deployed  in  Irag.  I 
have  deployed  three  times  in  2001  through  2002,  2003,  2004,  and  2008, 
and  in  support  of  Operation  Enduring  Freedom  and  Operation  Iraqi 
Freedom.  I  have  also  served  as  a  flight  instructor  for  3  years. 

As  a  reservist,  I  currently  work  on  planning,  which 
involves  concept  plans,  operations  plans,  and  execution  orders. 

After  leaving  active  duty  in  2009,  I  began  to  work  at  Booz  Allen  as  a 
contractor.  Today,  I  work  as  a  maritime  planner  for  Booz  Allen. 
Previously,  I  worked  for  Booz  Allen  on  matters  related  to  United 
States  Northern  Command  USNORTHCOM  Maritime  Division.  Currently  at 
Booz  Allen,  I  work  on  USNORTHCOM  J-6  security  cooperation.  In  my 
work  for  the  J-6,  I  work  on  security  cooperation  between  the  United 
States  and  Mexico.  Specifically,  I  work  on  command  and  control  of 
communications,  computers,  and  information,  C4I. 

I  have  worked  with  classified  information  in  my  career  with 
Booz  Allen  and  as  an  active  duty  and  reservist  pilot.  As  a  pilot,  I 
worked  with  classified  information  daily  for  flights,  mission 
planning,  mission  briefing,  and  certain  information  about  the  planes. 
Previously,  I  worked  with  classified  information  in  my  work  at  Booz 
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Allen  in  the  J-5  pertaining  to  homeland  defense  plans,  and  planning 
and  development  of  specific  plans  for  maritime  activities,  to  include 
work  with  the  United  States  Coast  Guard.  I  have  received  a  one  and 
one  half  hour  PowerPoint  training  on  classified  procedures  and  spent 
about  an  hour  quarterly  on  training.  I  have  received  derivative 
classification  training.  I  have  also  used  classification  guides  in 
my  work;  I  have  used  the  USNORTHCOM  classification  guide  to  determine 
the  classification  status  of  the  information.  I  did  not  consider  the 
following  when  making  any  determination:  One:  What,  if  any,  of  this 
material  was  included  in  open  source  reporting  and;  two,  what,  if 
any,  of  this  material  was  available  in  unclassified  publications, 
such  as  Army  Regulations  or  Field  Manuals. 

In  2001,  I  was  mobilized  to  United  States  Central  Command, 
USCENTCOM.  I  was  mobilized  to  the  J-5  planning  office,  Yemen  Branch. 
While  in  this  position,  I  worked  on  country-to-country  action  plans 
and  worked  with  the  United  States  Embassy  in  Yemen  and  the  Yemeni 
military  on  plans  and  security  cooperation. 

While  mobilized  at  USCENTCOM,  I  was  tasked  through  the 
Tasking  Management  Tool  to  conduct  a  review  for  classified 
information.  The  J-5  office  plans  through  the  director,  who  receives 
taskers.  The  director  passed  the  tasker  to  me.  I  received  the 
submitted  documents  from  the  USCENTCOM  JAG  office.  My  assignment 
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required  me  to  determine  whether  the  submitted  documents  contained 
classified  information  at  the  time  they  were  compromised. 

In  my  capacity  as  the  person  tasked  with  reviewing  the 
submitted  documents,  I  reviewed  the  documents  for  classified 
USCENTCOM  J-5  equities.  I  reviewed  approximately  40  documents 
pertaining  to  United  States  v.  Private  First  Class  Bradley  Manning, 
which  the  prosecution  provided  to  USCENTCOM.  The  documents  provided 
by  prosecution,  submitted  documents,  included,  among  others, 
documents  from  the  Combined  Information  Data  Network  Exchange 
Afghanistan,  CIDNE-A,  and  other  documents  related  to  the  AR  I  - 
investigation  of  the  Farah  incident. 

When  conducting  the  review,  I  looked  at  USCENTCOM 
classification  guides  and  Executive  Order  13526  and  its  predecessors. 
I  reviewed  each  submitted  document  line  by  line  for  classified 
information  by  applying  the  USCENTCOM  classification  guides.  I 
annotated  the  basis  for  each  classification  decision  in  my  sworn 
declaration  dated  21  October  2011,  Bates  Numbers:  00527378  through 
00527397.  Prosecution  Exhibit  87  for  Identification  is  this 
declaration.  All  documents  noted  in  the  declaration  contained 
classification  markings  and  were  properly  classified  at  least  at  the 
Secret  level,  hereinafter  "reviewed  documents". 

Based  on  my  military  experience,  I  had  prior  familiarity 
with  the  types  of  documents  and  information  I  reviewed.  During  my 
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deployments,  I  worked  with  similar  classified  information  pertaining 
to  mission  planning,  mission  details,  weapons  systems,  and  maps  of 
troop  locations. 

The  reviewed  documents  consisted  of  documents  collected 
from  CIDNE-A  and  other  documents  related  to  the  Farah  investigation. 
The  reviewed  documents  contained  military  information,  to  include 
military  plans,  weapons  systems,  or  operations;  significant  activity 
reports,  SIGACT;  operational  code  words  when  identified  with  mission 
operations;  SIGACTs  related  to  fact  of  and  general  type  of 
improvised  explosive  device  ( IED)  attack  on  specific  location  on 
specific  date,  which  would  have  been  known  by  the  enemy  that  was  the 
subject  of  that  report;  participating  units,  and  details  of  movements 
of  US  friendly  forces;  concept  of  operations  (CONOPS) ,  Operation 
Orders  (OPORD) ,  or  Fragmentary  Orders  (FRAGOs);  vulnerabilities  or 
capabilities  of  systems,  installations,  infrastructures,  projects, 
plans,  or  protection  services  relating  to  national  security;  and 
limitations  and  vulnerabilities  of  US  forces  in  combat  area.  CONOPs 
are  properly  classified  as  confidential  upon  execution  and  can  be 
declassified  1  year  after  completion.  Participating  units,  including 
types,  vulnerabilities,  locations,  quantities,  readiness  status, 
deployments,  redeployments,  and  details  of  movement  of  U.S.  and 
friendly  forces  in  operations  can  be  properly  declassified  upon 
execution. 
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I  reviewed  and  determined  that  21  SIGACTs  from  CIDNE-A 
contained  classified  information  according  to  the  classification 
guides  and  my  knowledge  and  experience.  These  reviewed  SIGACT 
reports  from  CIDNE-A  were  all  marked  as  Secret.  The  reviewed  SIGACTs 
from  CIDNE-A  contained  multiple  forms  of  military  information,  to 
include  information  related  to  deployed  —  deploying  quick  response 
forces  and  code  words,  reported  the  effectiveness  of  IED  attacks, 
which  would  be  known  to  the  enemy  that  was  the  subject  of  those  —  of 
that  report,  report  the  locations  of  IED  attacks,  which  would  be 
known  to  the  enemy  that  was  the  subject  of  that  report,  identified 
IED  tactics,  techniques  and  procedures  (TTPs)  for  responding  to  IED 
attacks,  identified  TTPs  for  identifying  and  neutralizing  IEDs, 
friendly  action  reports  of  finding  and  clearing  caches,  weapons 
systems  and  capabilities,  sources  and  methods  of  Intelligence 
engagement,  rules  of  engagement,  CONOPS,  descriptions  of  United 
States  forces,  TTPs  for  mission  execution,  anticipated  enemy 
reaction,  flexible  deterrent  options,  code  words,  assistance  by 
local  foreign  nationals  in  locating  suspects,  and  details  of  enemy 
attacks.  CONOPs  are  properly  classified  as  Confidential  upon 
execution  and  can  be  declassified  1  year  after  completion. 
Participating  units,  including  types,  vulnerabilities,  locations, 
quantities,  readiness  status,  deployments,  redeployments,  and  details 
of  movement  of  U.S.  and  friendly  forces  in  operations  can  be  properly 


8222 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 


o 


o 


declassified  upon  execution.  The  21  CIDNE-A  reports  that  contained 
J-5  equities  are  located  in  Appellate  Exhibit  501  and  have  been  — 
and  have  the  Bates  Numbers  of  00377846  through  00377846  [sic]  and 
00377888  through  00377910.  These  CIDNE-A  reports  are  contained 
within  PE  89  for  Identification. 

Additionally,  I  reviewed  the  AR  15-6  investigation  into  a 
military  operation  that  occurred  in  Farah  province,  Afghanistan  on  or 
about  4  May  2009.  The  AR  15-6  investigation  into  the  Farah  incident 
was  focused  on  investigating  the  circumstances  surrounding  a  large- 
scale  civilian  casualties  (CIVCAS)  incident.  The  incident  occurred 
in  Gharani,  which  is  a  village  in  Farah  Province,  Afghanistan.  As 
noted  in  PE  90  for  ID,  I  found  that  13  of  the  Farah  investigation 
documents  contained  classified  information  I  believed  to  be 
sensitive  and  classified  because  the  documents  reveal  TTPs,  troop 
movements,  close  air  support,  troops  in  combat  (TIC) ,  and  graphics 
showing  troop  movements.  The  Farah  investigation  documents  that 
contained  J-5  Equities  are  located  in  AE  501  and  have  the  Bates 
numbers  00377425  through  00377480,  00377496,  00377627,  00377672 
through  00377674,  0038029,  00378066,  00378071,  00378079,  and 
00378082.  These  documents  are  contained  within  PE  90  for  ID. 

I  reviewed  PE  66  for  ID,  a  CD  contained  the  video  named  B  - 
-  "BE22  PAX.wmv".  This  video,  Gharani  video,  is  a  video  depicting 
portions  of  a  military  operation  in  Farah  Province,  Afghanistan, 
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separately  from  the  review  I  conducted  for  classified  USCENTCOM  J-5 
equities . 

While  on  active  duty  from  2007  through  2009,  I  was  the 
Strike  Operations  Officer  responsible  for  planning,  training,  and 
coordinating  air  wing  and  air-to-ground  operations,  which  involved 
coordinating  with  the  Army  ground  liaison  for  mission  coordination  of 
ground  targets.  In  this  capacity  I  reviewed  video  recordings  of 
combat  missions.  The  videos  captured  flight  operations  using  forward 
looking  infrared  radar  ( FLIR) .  I  reviewed  the  videos  to  ensure  the 
mission  achieved  its  goal,  hit  the  target,  or  reviewed  the 
information  captured  in  a  reconnaissance  capacity.  I  reviewed 
hundreds  of  these  videos  for  validation.  The  Gharani  video  is 
similar  to  the  hundreds  of  videos  I  reviewed  as  a  strike  operations 
officer . 

I  reviewed  the  Gharani  video  for  sensitive  military 
information.  I  relied  on  my  experience  while  conducting  my  review 
for  sensitive  and  classified  information  of  the  Gharani  video.  In 
particular,  I  relied  on  my  training  and  schooling,  experience  as  a 
flight  instructor,  experience  with  operating  FLIR  systems,  and 
experience  reviewing  videos  that  record  imagery  as  presented  in  the 
FLIR  System.  After  my  review  of  the  above  referenced  documents  for 
USCENTCOM  J-5  equities,  I  forwarded  my  conclusions  and 
recommendations  to  Deputy  Commander,  USCENTCOM,  an  Original 
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Classification  Authority  for  his  final  determination  as  to  whether 
the  information  is  properly  classified. 

Your  Honor,  the  United  States  moves  to  admit  Prosecution 
Exhibit  87  for  Identification  as  Prosecution  Exhibit  87. 

ADC [MAJ  HURLEY]:  No  objection,  ma'am. 

TC [MAJ  FEIN]:  And  the  United  States  moves  to  admit  Prosecution 
Exhibit  66  for  Identification  as  Prosecution  Exhibit  66. 

ADC [MAJ  HURLEY]:  No  objection. 

MJ:  All  right.  Both  exhibits  are  admitted.  May  I  see 

Prosecution  Exhibit  66,  please?  All  right.  Prosecution  Exhibits  66 
and  87  are  admitted. 

TC [MAJ  FEIN]:  Ma'am,  the  United  States  requests  a  brief  comfort 
break. 

MJ:  All  right.  Any  objection? 

ADC [MAJ  HURLEY] :  No,  ma'am. 

MJ:  Court  is  in  recess  until  20  minutes  to  11. 

[The  court-martial  recessed  at  1036,  11  June  2013.] 

[The  court-martial  was  called  to  order  at  1047,  11  June  2013.] 

MJ:  Court  is  called  to  order.  Let  the  record  reflect  all 

parties  present  when  the  Court  last  recessed  are  again  present  in 
court.  Is  the  government  ready  to  call  the  next  witness? 

ATC [CPT  von  ELTEN] :  Yes,  ma'am.  United  States  calls  —  or 
recalls  Special  Agent  Mander. 
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SPECIAL  AGENT  MARK  MANDER,  U.S.  Army,  was  recalled  as  a  witness  for 
the  prosecution,  was  reminded  he  was  still  under  oath,  and  testified 
as  follows: 

DIRECT  EXAMINATION 

Questions  by  the  assistant  trial  counsel  [CPT  von  ELTEN] : 

Q.  What  is  an  HR? 

A.  An  IIR,  that's  an  acronym  that  stands  for  Intelligence 
Information  Report. 

Q.  Who  creates  an  IIR? 

A.  Various  military  intelligence-like  organizations  throughout 
DoD  as  well  as  other  agencies  that  deal  with  intelligence  typically 
create  them. 

Q.  What  are  some  examples  of  some  of  those  agencies? 

A.  Army  Military  Intelligence,  I  know  the  FBI  creates  them, 
NCIS ,  Air  Force  Office  of  Special  Investigations.  There's  others. 

Q.  What  types  of  information  do  they  contain? 

A.  They  contain  all  types  of  intelligence  information  relating 
to  counter  terrorism  information,  things  involving  cyber  activities, 
as  well  as  things  about  foreign  militaries,  things  like  that. 

Q.  And  who  writes  them? 

A.  Typically  individuals  who  are  assigned  in  military 
intelligence-like  units  or  other  intelligence  type  units  that  they 
are  designated  to  produce  those  types  of  reports. 
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Q.  What  is  the  basis  of  the  content  in  an  HR? 

A.  The  basis  of  the  contents  can  be  from  sources,  people  that 
provide  information,  it  can  be  from  other  military  or  intelligence 
organizations  that  actually  observe  activities  for  themselves  and 
they  want  to  report  it  and  that's  essentially  the  mechanism  the 
intelligence  community  uses  to  share  that  information  to  other 
elements . 

Q.  And  that  leads  me  to,  how  are  they  used  broadly? 

A.  Well,  there's  a  system,  and  I'm  not  super  familiar  with  it 
because  I  do  criminal  investigation,  but  generally  speaking,  someone 
will  produce  a  report  that  contains  information  or  intelligence  in 
it.  Other  elements  will  then  see  that  report  and  they  can  then 
generate  questions  or  follow-up  questions,  which  then  in  turn  produce 
more  reports. 

Q.  And  how  are  they  organized? 

A.  Can  you  be  more  specific? 

Q.  Is  it  like  a  fact  summary,  an  analysis  section,  does  it 

vary? 

A.  It  probably  varies.  It  depends  on  the  nature  of  the 
information.  Sometimes  they're  very  short,  maybe  like  just  one  or 
two  pages,  sometimes  they're  very  long,  multiple  pages  and  they,  you 
know,  are  kind  of  organized  in,  they  usually  have  across  the  top  like 
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a  classification,  there  will  be  like  a  section  that  shows  the 
distribution  of  who  got  the  report. 

ADC [CPT  TOOMAN] :  Your  Honor,  we'll  object  based  on  personal 

knowledge.  The  witness  has  said  he's  not  familiar  —  super  familiar 
with,  to  use  his  words,  with  this  process  so  we  would  object  on 
personal  knowledge. 

A.  I  have  seen  many  intelligence  reports,  but  I  don't  know  all 
about  the  process  of  how  they're  created. 

MJ:  All  right.  Then  stop  asking  about  the  process  of  how 

they're  created.  Sustained. 

Q.  Where  do  you  find  IIRs? 

A.  There's  two  systems  that  I  would  use  to  look  up  IIRs.  I 
believe  I  can  name  the  two  systems  here.  One  of  them  is  called  Hot- 
R,  H-O-T-R,  and  I  don't  know  what  that  acronym  stands  for  or  if  it 
stands  for  anything,  and  then  there's  another  system  called  the  Multi 
Media  Manager,  or  they  typically  call  it  M3.  I  know  that  there's 
others . 

Q.  What  are  some  of  the  others? 

A.  I  don't  know  the  others,  I  just  know  that  there  are  others 
and  that  certain  systems  are  based  on  like  the  organizations  that 
produce  the  reports.  So,  for  example,  the  DoD  reports,  most  of  them 
are  in  Hot-R,  but  if  you  want  to  see  a  report  that  was  published  by 
another  organization  such  as  like  the  FBI,  you  would  use  M3. 
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Q.  What  search  engine  do  you  use  to  search  for  IIRs? 

A.  Intelink  is  one  of  the  systems  you  can  use  to  search. 

Q.  Do  you  use  Intelink  to  search  for  IIRs? 

A.  Occasionally.  Typically  you  can  also  log  into  one  of  the 
systems  I  mentioned  and  then  search  for  the  IIRs  that  way  as  well. 

Q.  How  are  the  results  displayed  in  Intelink? 

A.  They're  typically  displayed  kind  of  similar  to  what  Google 
looks  like,  it's  somewhat  similar. 

Q.  And  when  have  you  used  IIRs? 

A.  Well,  specifically  in  this  case  we  did  look  for  IIRs  that 
related  to  WikiLeaks,  that  keyword. 

ATC [CPT  von  ELTEN] :  Retrieving  Prosecution  Exhibit  99  for 
Identification.  Handing  it  to  the  witness. 

M J :  Just  a  minute.  Yes. 

ADC [CPT  TOOMAN] :  Can  I  take  a  look  at  that? 

ATC [  CPT  von  ELTEN]:  I'm  sorry. 

Q.  What  have  I  handed  you.  Agent  Mander? 

A.  This  appears  to  be  an,  excuse  me,  a  declassified  version  of 

an  HR  specifically  related  to  the  WikiLeaks  organization. 

Q.  And  what  is  it  numbered? 

A.  The  number  is  IIR  5391001408. 

Q.  And  what  is  the  numbering  convention  based  on  your 
experience? 
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A.  The  numbers  are  broken  by  spaces.  The  first  number,  5,  I 
believe  that  indicates  the  general  organization  such  as  Army,  Navy, 
Air  Force.  The  second  number  is  a  three  digit  number,  391,  would  be 
the  specific  organization  within  that  service.  The  fourth  set  or, 
excuse  me,  third  set  of  numbers,  it's  a  four  digit  number,  0014, 
would  be  the  serial  number  of  the  report.  And  then  the  last  two 
numbers,  08,  would  be  the  year,  the  two  digit  year  of  the  report. 

Q.  Would  you  please  take  a  moment  to  review  the  report? 

[There  was  a  brief  pause  while  the  witness  reviewed  the  exhibit.] 

A.  Okay. 

Q.  What's  an  overview  of  the  content? 

A.  Generally  speaking,  the  content  of  this  HR,  it  more  or 
less  spells  out  that  the  WikiLeaks  organization  was  established  in 
December  2006.  Its  point  was  to  encourage  the  anonymous  posting  of 
sensitive  government  and  corporate  documents.  It  describes  the 
organization  as  a  uncensorable  Wikipedia  for  untraceable  mass 
document  leaking  and  analysis.  And  it  also  goes  through,  gives  more 
details  as  well  as  mentions  a  large  number  of  what  we  call  mirror 
sites  and  it  gives  a  long  list  of  it. 

MJ:  Yes? 

ADC [CPT  TOOMAN] :  We'll  object  based  on  relevance.  Your 

Honor . 
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ATC [CPT  von  ELTEN] :  Your  Honor,  I'm  just  having  him  lay 
foundation  for  the  contents  of  the  document,  to  authenticate  it. 

M J :  What's  the  relevance? 

ATC [  CPT  von  ELTEN]:  The  relevance  of  it? 

MJ:  Yes. 

ATC [CPT  von  ELTEN]:  I'm  going  to  do  that  right  now. 

MJ:  Well,  why  don't  you  tell  me. 

ATC [CPT  von  ELTEN]:  Sorry,  ma'am.  The  relevance  is  this 
document,  we  have  evidence  was  searched  for  by  PFC  Manning  on 
Intelink. 

MJ:  Overruled. 

ATC [CPT  von  ELTEN]:  Retrieving  Prosecution  Exhibit  99  for 
Identification  from  the  witness  and  handing  the  witness  Prosecution 
Exhibit  85. 

MJ:  That's  99  for  Identification,  right? 

ATC [CPT  von  ELTEN]:  Yes,  ma'am.  Agent  Mander  - 

MJ:  Just  a  minute. 

ATC [CPT  von  ELTEN]:  I'm  handing  the  witness  Prosecution  Exhibit 

85. 

MJ:  For  Identification? 

ATC [CPT  von  ELTEN]:  No,  ma'am. 

MJ:  It's  admitted? 
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Questions  continued  by  the  assistant  trial  counsel  [CPT  von  ELTEN] : 

Q.  Please  review  Line  19. 

MJ:  Stop  there  for  just  a  moment.  I  want  to  check  with  the 

court  reporter  for  the  admissibility  —  has  Prosecution  Exhibit  85 
been  admitted? 

REPORTER:  [Indicating  an  affirmative  response.] 

MJ:  Go  ahead. 

Q.  What  was  the  —  Where  was  the  search  conducted  reflected  in 
Line  19? 

ADC [CPT  TOOMAN] :  Your  Honor,  the  defense  is  going  to  object. 

I  believe  that  this  exhibit  is  computer  logs.  This  isn't  a  computer 
expert.  The  government  hasn't  laid  the  foundation  that  this  witness 
can  actually  interpret  the  Intelink  raw  data. 

MJ:  Lay  a  foundation. 

Q.  Agent  Mander,  what  is  your  position? 

A.  I'm  a  special  agent  with  the  Army  CID,  specifically  the 
computer  crime  investigative  unit. 

Q.  And  what  type  of  computer  crimes  do  you  investigate? 

A.  Generally  speaking,  we  investigate  network  intrusion  type 
incidents . 

Q.  Do  you  review  computer  logs  as  part  of  that  work? 

A.  Yes,  we  do. 

Q.  And  what  is  a  log? 
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A.  A  log  file  is  basically  a  list  of  activity  that  is  recorded 
typically  by  a  computer  or  other  types  of  systems  that  show  what 
activities  occurred. 

Q.  And  what  kind  of  activities  are  recorded? 

A.  Typically  the  accesses  to  a  computer  system  or  perhaps 
maybe  traffic  that  transits  Internet  device  such  as  a  router  or 
switch,  things  like  that. 

Q.  And  how  often  do  you  review  computer  logs? 

A.  I  used  to  review  them  all  the  time.  Now  not  so  much,  but  I 

still  see  them  fairly  frequently. 

Q.  And  how  familiar  are  you  with  computer  logs? 

A.  Fairly  familiar. 

MJ:  Overruled. 

ADC [CPT  TOOMAN] :  Your  Honor,  the  defense  would  request  the 

opportunity  to  voir  dire  this  witness  about  his  knowledge  of  how 
computer  logs  are  created. 

MJ:  All  right.  I'll  let  you  go  ahead  and  do  it.  Are  you 

finished  laying  the  foundation  or  do  you  have  more  foundation  for 
him? 

ATC [CPT  von  ELTEN] :  Just  a  little  more,  ma'am. 

MJ:  Go  ahead. 

Q.  What  was  the  source  identified  in  Line  19? 
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INSTRUCTIONS  FOR  PREPARING  AND  ARRANGING  RECORD  OF  TRIAL 


USE  OF  FORM  -  Use  this  form  and  MCM,  1984, 
Appendix  1 4,  will  be  used  by  the  trial  counsel  and 
the  reporter  as  a  guide  to  the  preparation  of  the 
record  of  trial  in  general  and  special  court-martial 
cases  in  which  a  verbatim  record  is  prepared.  Air 
Force  uses  this  form  and  departmental 
instructions  as  a  guide  to  the  preparation  of  the 
record  of  trial  in  general  and  special  court-martial 
cases  in  which  a  summarized  record  is  authorized. 
Army  and  Navy  use  DD  Form  491  for  records  of 
trial  in  general  and  special  court-martial  cases  in 
which  a  summarized  record  is  authorized. 
Inapplicable  words  of  the  printed  text  will  be 
deleted. 

COPIES  -  See  MCM,  1984,  RCM  1103(g).  The 
convening  authority  may  direct  the  preparation  of 
additional  copies. 

ARRANGEMENT  -  When  forwarded  to  the 
appropriate  Judge  Advocate  General  or  for  judge 
advocate  review  pursuant  to  Article  64(a),  the 
record  will  be  arranged  and  bound  with  allied 
papers  in  the  sequence  indicated  below.  Trial 
counsel  is  responsible  for  arranging  the  record  as 
indicated,  except  that  items  6,  7,  and  15e  will  be 
inserted  by  the  convening  or  reviewing  authority, 
as  appropriate,  and  items  10  and  14  will  be 
inserted  by  either  trial  counsel  or  the  convening  or 
reviewing  authority,  whichever  has  custody  of 
them. 

1 .  Front  cover  and  inside  front  cover  (chronology 
sheet)  of  DD  Form  490. 

2.  Judge  advocate's  review  pursuant  to  Article 
64(a),  if  any. 

3.  Request  of  accused  for  appellate  defense 
counsel,  or  waiver/withdrawal  of  appellate  rights, 
if  applicable. 

4.  Briefs  of  counsel  submitted  after  trial,  if  any 
(Article  38(c)). 

5.  DD  Form  494,  "Court-Martial  Data  Sheet." 

6.  Court-martial  orders  promulgating  the  result  of 
trial  as  to  each  accused,  in  10  copies  when  the 
record  is  verbatim  and  in  4  copies  when  it  is 
summarized. 

7.  When  required,  signed  recommendation  of 
staff  judge  advocate  or  legal  officer,  in  duplicate, 
together  with  all  clemency  papers,  including 
clemency  recommendations  by  court  members. 


8.  Matters  submitted  by  the  accused  pursuant  to 
Article  60  (MCM,  1984,  RCM  1105). 

9.  DD  Form  458,  "Charge  Sheet"  (unless  included 
at  the  point  of  arraignment  in  the  record). 

10.  Congressional  inquiries  and  replies,  if  any. 

11.  DD  Form  457,  "Investigating  Officer's  Report," 
pursuant  to  Article  32,  if  such  investigation  was 
conducted,  followed  by  any  other  papers  which 
accompanied  the  charges  when  referred  for  trial, 
unless  included  in  the  record  of  trial  proper. 

12.  Advice  of  staff  judge  advocate  or  legal  officer, 
when  prepared  pursuant  to  Article  34  or  otherwise. 

13.  Requests  by  counsel  and  action  of  the 
convening  authority  taken  thereon  (e.g.,  requests 
concerning  delay,  witnesses  and  depositions). 

14.  Records  of  former  trials. 

15.  Record  of  trial  in  the  following  order: 

a.  Errata  sheet,  if  any. 

b.  Index  sheet  with  reverse  side  containing 
receipt  of  accused  or  defense  counsel  for  copy  of 
record  or  certificate  in  lieu  of  receipt. 

c.  Record  of  proceedings  in  court,  including 
Article  39(a)  sessions,  if  any. 

d.  Authentication  sheet,  followed  by  certificate 
of  correction,  if  any. 

e.  Action  of  convening  authority  and,  if  appro¬ 
priate,  action  of  officer  exercising  general  court- 
martial  jurisdiction. 

f.  Exhibits  admitted  in  evidence. 

g.  Exhibits  not  received  in  evidence.  The  page 
of  the  record  of  trial  where  each  exhibit  was 
offered  and  rejected  will  be  noted  on  the  front  of 
each  exhibit. 

h.  Appellate  exhibits,  such  as  proposed  in¬ 
structions,  written  offers  of  proof  or  preliminary 
evidence  (real  or  documentary),  and  briefs  of 
counsel  submitted  at  trial. 
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